Guide
API keys vs per-action authorization
Standing credentials vs single-use authority.
Bearer tokens and API keys grant standing access. Per-action authorization evaluates each high-risk mutation before execution — with evidence for every outcome.
The bearer key problem
CI runners, support agents, and payment automations often hold long-lived API keys. Any compromise or misconfiguration grants unlimited actions until rotation — discovered from logs, if at all.
Per-action authorization
The question shifts from 'does this actor have a key?' to 'is this exact action authorized right now?'
- Each proposed action is evaluated against policy in force
- Approvals are single-use and bound to the action hash
- DENY stops execution before downstream APIs mutate state
- Evidence preserves who decided what
Migration path
Start with shadow mode: record what would have been ALLOW, DENY, or APPROVAL_REQUIRED without enforcing. Promote gating workflow by workflow after readiness review.
Frequently asked questions
Do we remove API keys entirely?
Not necessarily. Keys may remain for authentication; authority checks gate consequential mutations.
What about rate limits?
Rate limits cap volume. Action authority gates individual high-risk actions with policy and approval context.
