Dispatch
Cloudflare's Agent Access Model proposes capability ratcheting: agent permissions can only narrow mid-task
Cloudflare published an architecture for securing task-scoped agents around five principles, the sharpest being 'capability ratcheting' — once a capability is removed during execution it requires fresh authorization, so trust can only narrow. It specifies six components including an Agent Identity Broker issuing task-scoped credentials at dispatch, a Trust Ratchet that statefully narrows capability on protected events, and enforcement at tool and network-egress boundaries rather than in prompts. The paper is explicit that this is proposed architecture, not shipping product, built on OAuth Token Exchange (RFC 8693) and DPoP (RFC 9449), and that multiplayer access control remains unsolved.
↳ Follow the thread