Open-source delegated authorization for AI agents — RFC 8693 on-behalf-of tokens, offline-verified constraints, monotonic attenuation. Single Go binary, self-hostable.
-
Updated
Jun 23, 2026 - Go
Open-source delegated authorization for AI agents — RFC 8693 on-behalf-of tokens, offline-verified constraints, monotonic attenuation. Single Go binary, self-hostable.
CFO Shield is a secure execution engine for AI agents. Powered by the Auth0 Token Vault and RFC 8693, this Next.js and Go architecture safely brokers B2B workflows across Google, Notion, GitHub, and LinkedIn, keeping the principal in total cryptographic control of the agent's blast radius.
Spring Boot pod-to-pod auth via Keycloak — Kubernetes workload identity POC with 45-test Playwright suite, full docs, screenshots, and a one-shot kind bootstrap.
To associate your repository with the rfc-8693 topic, visit your repo's landing page and select "manage topics."