August 2026 Summaries

A live cross-company test of the Ratify Protocol and Agent Relay explored a more controlled alternative to granting external AI agents broad API keys, GitHub App permissions, or service-account access. The system issued a signed, verifiable permission certificate limiting an agent to a specific repository and folder, allowing it to make changes and open a pull request while preventing it from exceeding its delegated authority; any work delegated to a sub-agent received still narrower permissions and a shorter time window. During the run, the repository owner revoked the certificate remotely, and the agent’s subsequent commands were blocked within seconds despite the certificate having hours remaining. Revocations were delivered as signed metadata in a standard agent-to-agent message, then verified against keys exchanged during setup, avoiding separate shutdown integrations for each partner. Public records of certificates, revocations, signed receipts, repositories, and the deployment container image are available to support independent reproduction and testing.

Agent Relay and the Ratify Protocol team are exploring how autonomous agents from different organizations can securely communicate and collaborate without relying on direct trust or real-time verification from an authority. Ratify provides delegated-authority proofs, analogous to verifiable permission slips, enabling agents to demonstrate what actions they are authorized to perform. In an initial test involving two simulated companies and Claude and Codex agents, six scenarios were evaluated, including four attempted unauthorized actions, which were rejected within milliseconds with verifiable explanations. The teams found that general permissions, such as authorization to write files, were insufficient because they did not restrict access to a specific repository or path; after identifying shortcomings in an application-level check, they moved enforcement to the operating system kernel. The next phase will extend Ratify’s SDK to bind permissions to specific repositories and files, followed by an end-to-end demonstration of agents from separate Relay deployments conducting authorized work across a network.