What we’ve shipped, newest first. Everything here is live in production; where a feature is limited to certain plans, the entry says so.
Last updated
Each allowed, held or refused call is written with a compact signed statement: which agent, which owner approved, which scope, which policy version and rule, which request. Anyone can verify it against our published key set and the broker’s did:web document, for the life of the audit row, with no access to our database. Refusals get receipts too.
Every plan.
A grant can now say to whom: allow-list Slack channels or email domains, and have the broker ask first, or refuse, when a message would leave your organisation. Approve or deny from the desktop or mobile notification itself. Stripe gained 28 endpoint-enforced scopes, and the API document is now held to the live route table by a contract test.
Recipient rules and the outside-organisation guardrail are on Studio and above.
Every agent can publish a W3C did:web document over its signing key. The same grant-and-policy check that gates every call answers ToIP TRQP v2 authorisation and recognition queries for partners.
A single CEL expression on a policy rule, evaluated inside the policy kernel with the request in scope: amount under a limit, only during business hours, skip the ask if a person approved the same thing ten minutes ago. It fails closed, and its trace is recorded in the audit row and the signed receipt.
Team plan and above.
When an agent hits an MCP server nobody has authorised yet, the consent link lands in the conversation and the call resumes once an admin approves, where the client supports it. One agent serving many people can now hold one upstream token per person, keyed by a salted hash, with a hosted consent link for people who aren’t AgentValet users. Every governed call carries a trace id in its response header, and the broker exposes OpenTelemetry traces and Prometheus metrics.
An orchestrator issues each worker its own short-lived identity with scopes cut down to a subset of its own, and the broker checks child against parent on every call. Revoke the parent and every child is contained on its next call. Available from the TypeScript and Python clients.
Children are one level deep: a child can’t issue children of its own.
Access follows your identity provider through a verified domain. Admins control member roles in the app, and members can’t change agents, platforms or grants. Connect two Slack workspaces or three GitHub accounts and grant an agent a specific one. Every connected account is labelled with its real identity, so the audit row says which account acted.
We don’t publish dates for work that hasn’t shipped. If there’s something you need, tell us: [email protected]. Receipts can be checked against our public signing keys.