Skip to main content
The bearer grant agent runtimes carry on every MCP tool call. Issued by the OAuth Authorization Server (Ory Hydra in production; HMAC-SHA256 in development). Verified by @glideco/grant-wrapper on every tool invocation per the F3 IRON RULE.

​
Canonical URL

https://glide.co/schemas/agent-banking/v1/grant.json (alias of scoped-grant-claims).

​
Required claims

ClaimTypeMeaning
substringPrincipal user ID (the human).
act.substringAgent principal ID (the acting agent).
azpstringAuthorized party — the registered MCP client_id.
aud.vault_idstringScoped resource vault (RFC 8707 resource indicator).
aud.entity_idstringScoped resource entity.
scopestring (space-separated)Closed-vocab SkillScope set.
policy_versionnumberEnvelope version at grant issue time. F5 mismatch detection.
iatnumberIssued at (epoch seconds).
nbfnumberNot before (epoch seconds).
expnumberExpiry (epoch seconds). Max TTL: 3600 (60 minutes).
jtistringServer-side grant ID for revocation.

​
Validation contract

@glideco/grant-wrapper re-validates every grant on every tool invocation:
  1. JWT signature — verified against the AS’s JWKS.
  2. exp not in past — bearer expiry.
  3. exp - iat ≤ 3600 — max TTL enforcement.
  4. aud.vault_id present + matches the resource indicator on the request — RFC 8707 enforcement.
  5. act.sub corresponds to a registered agent — DB lookup.
  6. F3 IRON RULE — fresh-read tenant verification. Re-reads the principal’s tenant from DB. Cached grant alone NEVER authorizes.
  7. policy_version matches the current envelope — mismatch raises PolicyStaleError (F5).

​
Step-up extension

When the requested tool action exceeds the envelope’s step_up_threshold_usd_cents, the gateway returns JSON-RPC -32003 with a step_up_url. The principal completes biometric approval; the gateway issues a step_up_sigil (single-use, F7); the agent retries with the sigil.

​
Example

{
  "iss": "https://auth.glide.example.com",
  "sub": "user_01H7...",
  "act": { "sub": "agent_01H8..." },
  "azp": "client_01H9...",
  "aud": {
    "vault_id": "vault_01HA...",
    "entity_id": "entity_01HB..."
  },
  "scope": "accounts:read payments:initiate audit:stream",
  "policy_version": 7,
  "iat": 1730000000,
  "nbf": 1730000000,
  "exp": 1730003600,
  "jti": "grant_01HC..."
}

​
Reading list