Caging Action, Not Speech: Capability-Gated Credential Containment for Autonomous Agents

Autonomous agents act with the credentials they hold, yet most defenses for them inspect what they say. A bearer credential such as an API key must exist as plaintext in the process that presents it, even when the connection is encrypted, and any code the agent runs in that process can read it. We present CAGE (Credential-bound Agent Gating Engine), a gate that keeps both the credential and the authority to use it outside the agent's reach. The agent holds a capability token bound to an operation class, a lifetime and a use budget. A separate trust domain, today an out-of-process broker, holds the credential and performs the operation. Authorization and charging form one atomic step that completes before the request carrying the credential is written, so through the broker or the Python binding a token's credential is sent at most as often as its budget allows. At the broker, an issuance policy frozen at start bounds what a stolen operator key can mint, as long as the attacker cannot restart the broker. Issuances, uses and refusals on the gated paths are appended to a hash-linked, sequenced log whose signed heads support external anchoring. We separate what holds by construction from what depends on the integrity of the enforcing boundary and on the correctness of the grant, state the conditions of each deployment tier, and list the attacks the design does not stop. The in-process and broker tiers are implemented and tested. The enforcing code of the broker tier is 2,782 lines of Rust, and a gated operation costs about 2 µs in the Rust core and 20 µs through the broker. A hardware enclave tier exists as a software mock.