Why AI Agents Should Get Task Grants Instead of API Keys

An API key answers one question: is this account allowed to do this kind of thing? It says nothing about the job you gave the agent this afternoon. If the account can delete posts, so can the agent, even though you only asked it to fix a typo.

People get away with that because people are careful and slow. Agents are neither. They retry. They run in parallel. They read web pages and emails that might contain instructions written by someone else. And their logs and environments get copied around, keys included.

A task grant flips the question around. Instead of asking what the account may do, it states what this one job needs. Fix the title of post 2. Title and content only. One try. Done within fifteen minutes.

What each limit buys you

Each part of a grant stops a different kind of mistake.

The post binding stops a call aimed at the wrong record. An agent that misreads an ID, or gets nudged toward another post, is refused with “Grant is bound to id 2; call sent id 3.”

The field list stops scope creep inside the right record. Permission to fix prose doesn’t quietly include permission to publish a draft. A call that also sets status is refused.

The use count stops repeats. Retry loops, duplicate jobs and two workers grabbing the same task all hit the same wall: the use is gone.

The deadline cleans up permission nobody used. A grant that’s still lying around tomorrow is a risk with no purpose.

None of these rules needs to understand the agent’s reasoning. They look at the call that actually arrived.

Where the key goes

The real key still exists. It just doesn’t go to the agent. Tokening keeps it in an encrypted vault and adds it to a call only after the call has passed its grant. The agent’s environment holds a grant secret instead. If that leaks, the damage is one edit to one post, probably already spent.

This only works if the agent can’t reach the API some other way. If the WordPress password is also sitting in the agent’s environment, the grant is decoration.

When a grant is too much ceremony

Read-only work on public data probably doesn’t need it. Neither does a script you wrote and run yourself. Grants earn their place where an agent writes to something you care about, especially when it also reads text you didn’t write.

The quick start sets one up in about fifteen minutes, and the demo shows each limit doing its job.