Keycard

https://www.keycard.ai/docs
Admin
Keycard is an agent access control and governance platform that enables secure, policy-driven...
Tokens:3,531
Snippets:35
Trust Score:7.2
Update:4 months ago
Show doc for...
Tokens:
Raw
### Agent Tool Discovery and Scoping Example

Source: https://www.keycard.ai

Demonstrates how Keycard scopes agent access by department and identity, showing an example of an agent discovering and being approved for tools like Salesforce and Google Drive, while Slack is pending approval.

```text
CLAUDE-SALES-03   
::: KEYCARD
▸ Resolving identity…
sarah@acme.co → Sales
▸ Discovering tools for Sales
✓ Salesforce ✓ Google Drive
⏳ Slack → Notion
✓ 2 tools ready, 1 pending approval
```

--------------------------------

### Keycard Event Feed Example

Source: https://www.keycard.ai

An example of the Keycard event feed, showing a real-time overview of allowed, escalated, and blocked actions. It includes timestamps, user information, tool calls, and outcomes.

```text
Event Feed Today
2,831allowed
14escalated
3blocked
94%compliance
10:41sf.pipeline.query — sarah@salesallowed
10:42sf.contacts.write — escalatedescalated
10:43sf.contacts.write — approvedapproved
10:44hubspot.contacts — blockedblocked
10:45notion.pages — allowedallowed
```

--------------------------------

### Keycard Actions Rejected Example

Source: https://www.keycard.ai

Illustrates examples of rejected agent actions due to policy violations, such as destructive actions requiring approval, actions outside the allowed scope, or attempts to access blocked resource classes.

```text
3 Actions rejected 
sarah@acme.org ⊘ project.delete Destructive action: approval required
mike@acme.org ⊘ team.update : billing-api Outside allowed scope
dev-bot ⊘ aws.s3.deleteBucket Blocked resource class
```

--------------------------------

### Composite Identity Graph Example

Source: https://www.keycard.ai

This illustrates how Keycard builds a composite identity from user, device, agent, and task information for a specific execution context. This resolved identity is then used to scope all subsequent actions.

```text
Identity Resolution
Task
fix rate limit bug
runtime
Agent
claude-code
workload ID
Who
sarah@acme.org
Okta SSO
Device
mbp-m3-001
mTLS cert
Composite Identity Resolved
```

--------------------------------

### Keycard Agent Live Demo Interaction

Source: https://www.keycard.ai

An example interaction with the Keycard Agent, a live demo of the agent control plane. It shows the agent's capabilities, including requesting calls, providing documentation, and demonstrating tool calls and token exchanges in real-time.

```text
Keycard AgentLive
Contact salesSales
Keycard
Hey! I'm Keycard's agent: a live Keycard-on-Keycard demo of the agent control plane. Ask me about Keycard, or I can help you schedule a call. Watch the audit trail to see my tool calls and token exchanges in real time.
Request a callHow does Keycard work?Walk me through the docsTell me about use cases
Audit LogArchitecture
Standby
0 events · session active
0 events · session active
```

--------------------------------

### Keycard Session Details Example

Source: https://www.keycard.ai

Provides a detailed view of a Keycard session, including user, time, tool calls, credentials used, and policies applied. It shows specific interactions like token exchanges and approval statuses for write operations.

```text
SESSIONS
Production / Sessions / bce9f…f250
Claude Code 
Completed bce9f-449b…1508f250
sarah@acme.org
Time **3m 22s** Tool calls **14** Credentials **3** Policies **1**
12:34:56  
+12ms
github.search_code →
Token exchanged · 3 results
12:34:56  
+15ms
github.get_file_contents →
Token reused · cached
12:34:56  
+63ms
linear.create_issue → OAuth
Token reused · Issue #LIN-482
12:34:56  
+63ms
postgres.query
Read-only · No PII detected
12:34:56  
+63ms
postgres.execute
Write blocked: requires human approval
12:34:56  
+63ms
postgres.executed
Write granted: **sarah@acme.org** approved (via Slack)
12:35:01  
+375ms
slack.post_message → S Slack
Token exchanged · Channel #eng-updates
```

--------------------------------

### Granting Access to Push GitHub Fixes

Source: https://www.keycard.ai

This example shows an agent being authorized to write to a GitHub repository to push a fix. The access is scoped to the repository and is granted based on the task context.

```text
github:contents:write
"Push fix to GitHub"
Whosarah@acme.orgOkta SSO
Devicembp-m3-001mTLS cert
Agentclaude-codeworkload ID
Taskfix rate limit bugruntime
"When fixing bugs: allow logs:read
Access Granted
Scopeacme/payments — contents:write
ContextSarah → Claude → KYC-847
Expirestask completion
```

--------------------------------

### Denying Access to PII Data

Source: https://www.keycard.ai

This example demonstrates Keycard blocking an agent's attempt to read PII from a production database due to a policy that forbids access to sensitive data. The denial is logged and flagged for a security team.

```text
prod-db:customers:read (PII)
"Read customer PII from prod DB"
Whosarah@acme.orgOkta SSO
Devicembp-m3-001mTLS cert
Agentclaude-codeworkload ID
Taskfix rate limit bugruntime
forbid when resource.tags.sensitivity == "pii"
resource:pii + trust:blocked
Access Denied
Scopeprod-db/customers — blocked
Contextflagged to security team
Loggedstreamed to SIEM
```

--------------------------------

### Keycard Session Audit Log

Source: https://www.keycard.ai

An example of a Keycard session audit log, showing events for shell commands and MCP tool calls. It highlights credential exchanges, allowed/denied paths, and purged tools.

```text
Session Audit · sarah@ Live
✓ mcp github.search_code token exchanged
✓ mcp linear.create_issue token exchanged
✓ shell python deploy.py env injected
✗ mcp slack.post_message server purged
✓ shell curl $GITHUB_TOKEN ... env injected
4 allowed 1 denied all paths → same audit trail
```

--------------------------------

### Build Agents with Keycard SDK

Source: https://www.keycard.ai

Initialize the Keycard authentication SDK with the issuer URL. This is the primary integration point for building agents.

```javascript
KeycardAuth({
  issuer: process.env.KEYCARD_ISSUER
})
```

--------------------------------

### Run Agent with Keycard Governance

Source: https://www.keycard.ai

Execute an agent using `keycard run` to virtualize .env and mcp.json, injecting credentials in-memory and auditing all execution paths. This ensures secrets never hit disk and provides a unified audit trail.

```bash
$ keycard run --agent cursor
▸ Authenticating... ✓ sarah@acme.co
▸ .env takeover... ✓ 4 secrets injected (in-memory)
▸ mcp.json takeover... ✓ 3 allowed, 2 purged
▸ Hooks verified... ✓ checksum match
✓ Cursor running under Keycard governance
Scoped: memory, skills, tools
MCP: github, linear, datadog
Purged: slack-mcp, aws-infra
```

--------------------------------

### Agent Identity and Access Control

Source: https://www.keycard.ai

This section contrasts insecure agent practices with Keycard's secure approach. It highlights how Keycard establishes composite identities, enforces scoped context, and provides runtime policy enforcement.

```text
1
Agents inherit the user’s full token No distinct agent identity means no way to scope, revoke, or trace.
2
Everything in the window is exposed PII, keys, and business logic sit in the context window and every tool can see. A single compromised server exfiltrates everything.
3
The model is the policy No enforcement between decision and action. Prompt injection redirects tool calls. Security owns the risk but has no runtime control.
4
Shared keys, full access, no scoping Long-lived API keys shared across agents. No per-request scoping, no attestation. Locking down agents means stalling.
5
No trail, no trust No structured audit across sessions or tool calls. Incident response ends with “we don’t know.” Without visibility, trust never builds.
1
Agents prove who they are Workload attestation (SPIFFE, k8s SA, cloud instance ID, mTLS) binds agent to a verified runtime. Combined with user, device, and task for composite identity.
2
Scoped context per tool Credentials never enter the context window. Each tool gets only the access it needs for this task.
3
Runtime enforcement at the gate Policy evaluates at credential issuance. No credential without approval. Observe-only mode, instant rollback.
4
Short-lived, task-scoped tokens Agents never see raw secrets. Credentials are identity-bound, resource-scoped, and revocable in-band.
5
Full trail across every session Tamper-resistant audit of every tool call and data access. Structured, queryable, streaming to your SIEM in real time.
```

--------------------------------

### Agent-Generated Python Script with In-Memory Credentials

Source: https://www.keycard.ai

This Python script demonstrates how an agent writes code that accesses AWS credentials injected in-memory by Keycard. The `.env` file does not exist on disk, and the credentials are short-lived and scoped.

```python
import os, boto3

# Agent writes this at runtime.
# .env doesn't exist on disk —
# Keycard injects creds in-memory.

key = os.environ["AWS_ACCESS_KEY_ID"]
secret = os.environ["AWS_SECRET_KEY"]

s3 = boto3.client("s3",
  aws_access_key_id=key,
  aws_secret_access_key=secret)

s3.upload_file("build.zip", "deploys", "v2.3.1.zip")
```

--------------------------------

### Granting Access to Create Linear Issues

Source: https://www.keycard.ai

This snippet illustrates an agent successfully gaining permission to create issues in Linear. The access is granted based on the task requirements and includes a scope for the Linear issue tracker.

```text
linear:issues:write
"Create issue in Linear"
Whosarah@acme.orgOkta SSO
Devicembp-m3-001mTLS cert
Agentclaude-codeworkload ID
Taskfix rate limit bugruntime
"When fixing bugs: allow issues:write"
task:bug-fix + issues:write
Access Granted
Scopelinear/KYC — issues:write
ContextSarah → Claude → KYC-847
Expirestask completion
```

--------------------------------

### Policy Evaluation - Permit Application

Source: https://www.keycard.ai

This policy permits application access unless the resource has 'pii' sensitivity and the application's trust level is 'shared'.

```policy
permit Application
  when resource.tags.sensitivity != "pii"
  unless application.tags.trust == "shared"
```

--------------------------------

### Granting Access to Datadog Logs

Source: https://www.keycard.ai

This snippet shows an agent being granted read-only access to Datadog logs for a specific task. The access is scoped and includes context about the user, device, agent, and task.

```text
KYC-847 sarah@acme.org 2m ago
Running
Keycard
datadog:logs:read
"Fetch error logs"
Whosarah@acme.orgOkta SSO
Devicembp-m3-001mTLS cert
Agentclaude-codeworkload ID
Taskfix rate limit bugruntime
"When fixing bugs: allow logs:read"
task:bug-fix + logs:read
ACCESS GRANTED
Scopedatadog/logs : read-only
ContextSarah → Claude → KYC-847
Expires15m (auto refresh on)
```

--------------------------------

### Token Exchange for Scoped Access

Source: https://www.keycard.ai

Exchange a Keycard JWT for a scoped access token to interact with external services like Google Calendar. Keycard handles the exchange but never sees the actual data.

```javascript
// Agent needs Google Calendar.
// Exchange the Keycard JWT for a scoped token.

const sts = new STSClient(config.keycardStsIssuerUrl)

const { access_token } = await sts.exchange(
  authInfo,
  "https://www.googleapis.com/calendar/v3",
  ["https://www.googleapis.com/auth/calendar"]
)

// Use it directly. Keycard never sees the data.
const resp = await fetch(calendarUrl, {
  headers: { Authorization: `Bearer ${access_token}` }
})
```

--------------------------------

### Policy Evaluation - Forbid Application

Source: https://www.keycard.ai

This policy forbids application access if the resource belongs to the 'hr' department and the application's trust level is 'shared'.

```policy
forbid Application
  when resource.tags.department == "hr"
  and application.tags.trust == "shared"
```
Tokens:
Raw