Mintplex-Labs/anything-llm
1
0
Fork 0
mirror of https://github.com/Mintplex-Labs/anything-llm.git synced 2026-07-21 01:25:28 -04:00
Code Issues 328 Packages Projects Releases 10 Wiki Activity

[GH-ISSUE #5377] Workspace-scoped agent governance — delegation per session with signed access receipts #5054

New Issue
Open
opened 2026-06-05 14:51:45 -04:00 by yindo · 1 comment
yindo commented 2026-06-05 14:51:45 -04:00
Owner
Copy Link
Copy Source

Originally created by @aeoess on GitHub (Apr 7, 2026).
Original GitHub issue: https://github.com/Mintplex-Labs/anything-llm/issues/5377

AnythingLLM gives agents access to documents, tools, and integrations. In a multi-user deployment, the trust boundary problem: every agent has access to every workspace it's configured for. There's no per-agent, per-conversation scoping. A user asking about their support ticket gets an agent that could, if prompt-injected, query every document in every connected workspace.

For enterprise deployments handling sensitive documents:

  • An agent in the HR workspace has the same tool access as one in the engineering workspace if both tools are configured
  • No signed proof of which documents were accessed during a conversation
  • No spend limits on LLM API calls per agent session

Governance per agent interaction:

import { createDelegation, governMCPToolCall, createAccessReceipt } from 'agent-passport-system'

// Agent session scoped to user's workspace + role
const sessionDelegation = createDelegation({
  delegatedTo: agentSessionKey,
  delegatedBy: workspaceAdminKey,
  scope: [
    'workspace:engineering:read',
    'tool:web_search',
    'tool:code_interpreter'
  ],
  // NOT in scope: workspace:hr, workspace:finance, tool:email_send
  spendLimit: 3000,  // $30 LLM API budget
  expiresAt: new Date(Date.now() + 3600_000),
  maxDepth: 0
})

// Agent tries to access HR workspace docs → blocked
const result = await governMCPToolCall(
  { name: 'workspace_query', arguments: { workspace: 'hr', query: 'salary data' } },
  async (args) => workspace.query(args),
  { passport: agentPassport, delegation: sessionDelegation, privateKey: agentSessionKey }
)
// Blocked: workspace:hr not in scope. Signed receipt generated.

Every document access produces a signed access receipt. Every tool call produces a governance receipt. The conversation has a tamper-evident audit trail proving what the agent was authorized to do and what it actually did.

npm install agent-passport-system (v1.36.2, Apache-2.0). Self-service at aeoess.com/portal.html.

Originally created by @aeoess on GitHub (Apr 7, 2026). Original GitHub issue: https://github.com/Mintplex-Labs/anything-llm/issues/5377 AnythingLLM gives agents access to documents, tools, and integrations. In a multi-user deployment, the trust boundary problem: every agent has access to every workspace it's configured for. There's no per-agent, per-conversation scoping. A user asking about their support ticket gets an agent that could, if prompt-injected, query every document in every connected workspace. For enterprise deployments handling sensitive documents: - An agent in the HR workspace has the same tool access as one in the engineering workspace if both tools are configured - No signed proof of which documents were accessed during a conversation - No spend limits on LLM API calls per agent session Governance per agent interaction: ```typescript import { createDelegation, governMCPToolCall, createAccessReceipt } from 'agent-passport-system' // Agent session scoped to user's workspace + role const sessionDelegation = createDelegation({ delegatedTo: agentSessionKey, delegatedBy: workspaceAdminKey, scope: [ 'workspace:engineering:read', 'tool:web_search', 'tool:code_interpreter' ], // NOT in scope: workspace:hr, workspace:finance, tool:email_send spendLimit: 3000, // $30 LLM API budget expiresAt: new Date(Date.now() + 3600_000), maxDepth: 0 }) // Agent tries to access HR workspace docs → blocked const result = await governMCPToolCall( { name: 'workspace_query', arguments: { workspace: 'hr', query: 'salary data' } }, async (args) => workspace.query(args), { passport: agentPassport, delegation: sessionDelegation, privateKey: agentSessionKey } ) // Blocked: workspace:hr not in scope. Signed receipt generated. ``` Every document access produces a signed access receipt. Every tool call produces a governance receipt. The conversation has a tamper-evident audit trail proving what the agent was authorized to do and what it actually did. `npm install agent-passport-system` (v1.36.2, Apache-2.0). Self-service at aeoess.com/portal.html.
yindo commented 2026-06-05 14:51:46 -04:00
Author
Owner
Copy Link
Copy Source

@jagmarques commented on GitHub (Apr 8, 2026):

The workspace isolation problem you're describing is exactly the gap that delegation-scoped governance addresses. The pattern that works in production: each agent session gets a scoped delegation token that lists the exact workspaces and tools it can access - nothing else is reachable regardless of what the prompt says.

For the tamper-evident receipts piece: asqav (https://github.com/jagmarques/asqav-sdk) does this for MCP tool calls. Every tool invocation produces a cryptographically signed receipt chained to the previous one - so you get a verifiable log of what the agent actually accessed, not just what it claimed it would access. The spend limit enforcement and audit trail pieces are built in.

<!-- gh-comment-id:4204619099 --> @jagmarques commented on GitHub (Apr 8, 2026): The workspace isolation problem you're describing is exactly the gap that delegation-scoped governance addresses. The pattern that works in production: each agent session gets a scoped delegation token that lists the exact workspaces and tools it can access - nothing else is reachable regardless of what the prompt says. For the tamper-evident receipts piece: asqav (https://github.com/jagmarques/asqav-sdk) does this for MCP tool calls. Every tool invocation produces a cryptographically signed receipt chained to the previous one - so you get a verifiable log of what the agent actually accessed, not just what it claimed it would access. The spend limit enforcement and audit trail pieces are built in.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
Desktop
Docker
Integration Request
Integration Request
OS: Linux
OS: Mobile
OS: Windows
UI/UX
blocked
bug
bug
core-team-only
documentation
duplicate
embed-widget
enhancement
feature request
github_actions
good first issue
investigating
needs info / can't replicate
possible bug
pull-request
Mirrored from GitHub Pull Request
 question
stage: specifications
wontfix
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: Mintplex-Labs/anything-llm#5054
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?