agent-obo

Overview ¶

Command agent-obo is a runnable, self-contained demonstration of Legant's agent-identity wedge: an AI agent acting *on behalf of* a human user with scoped, constrained, auditable delegation — RFC 8693 style.

It needs no database and no Docker. Run it with:

go run ./examples/agent-obo

The program plays three roles in one process:

• Legant — mints composite (sub/act) delegation tokens (the signer)
• The agent — exchanges a delegation for a token and calls an API
• Finance API — an independent resource server that holds ONLY Legant's public key and enforces scope + constraints on every call

Watch how authority can only ever narrow as it flows user -> agent -> sub-agent, and how the resource server can prove who is really behind each request.