oleg-tkachuk/limes

Budgeted, delegable, individually revocable capabilities for agentic workloads,
as a Go library.
A capability is a short-lived signed token that carries its own authority:
which operations, on which resources, for how much money and how many
requests, until when, and on whose behalf. An agent can hand a sub-agent a
strictly narrower copy — through the issuer, or offline as a Biscuit block
with no call at all — every charge counts
against the whole delegation chain, and any capability can be revoked
mid-flight along with everything delegated from it.
The module ships the primitive and its contracts; you supply the storage. Its
resolved dependency graph holds no database driver and no storage SDK, and
memstore, an in-memory implementation, is enough to start.
Limes was the fortified frontier of the Roman Empire — a line that marks how
far authority reaches (Wiktionary,
Wikipedia)).
mermaid
flowchart TB
op(["Operator"])
orch(["Orchestrator agent"])
worker(["Sub-agent"])
svc[" Your service Authorize · Bump · Charge"]
store[(" Your storage Store · UsageStore KeyResolver")]
op -- "Issue" --> orch
orch -- "Delegate / Attenuate narrower only" --> worker
orch -- "call + token" --> svc
worker -- "call + token" --> svc
svc --> store
op -. "Revoke" .-> store
classDef client fill:#E0F2FE,stroke:#0284C7,color:#0C4A6E
classDef role fill:#DCFCE7,stroke:#16A34A,color:#14532D
classDef store fill:#FEF3C7,stroke:#D97706,color:#78350F
class op,orch,worker client
class svc role
class store store
## Install
bash
go get github.com/oleg-tkachuk/limes@latest
limes needs Go 1.27 or later: its identifiers are the standard library's
uuid.UUID.
pgstore, otelmetric, redisreplay, exchange and biscuit are modules
of their own, on tag lines of their own: pin each by its tag, as
Versioning says. The Biscuit form is in biscuit: a verifier
or issuer that reads or seals it sets biscuit.Form() in its config.
## Five minutes
Setup errors are dropped below for brevity; each constructor returns one.
go
ctx := context.Background()
tenantID, runID := uuid.New(), uuid.New() // the standard library's uuid
key, := limes.GenerateKey()
kid, pub, priv := key.KeyID, key.Public(), key.Private
records, := memstore.NewStore(memstore.StoreConfig{}) // your Store
usage, := memstore.NewUsageStore(memstore.UsageStoreConfig{Records: records})
signer, := limes.NewSigner(limes.SignerConfig{KeyID: kid, Key: priv})
issuer, := limes.NewIssuer(limes.IssuerConfig{
Signer: signer, Store: records, IssuerName: "my-issuer",
})
keys, := jwks.NewStatic(jwks.StaticConfig{Keys: map[string]ed25519.PublicKey{kid: pub}})
verifier, := limes.NewVerifier(limes.VerifierConfig{
Keys: keys,
Revocations: records,
TrustedIssuers: []string{"my-issuer"},
})
issued, := issuer.Issue(ctx, limes.IssueRequest{
IssuedBy: limes.Principal{Subject: "operator@example.com"}, // who asked
ClientID: "my-agent", // the OAuth client: the software the agent runs as
Subject: limes.Principal{
Type: limes.PrincipalTypeAgent, TenantID: tenantID,
Subject: "research-orchestrator",
Agent: &limes.AgentPrincipal{AgentType: "my-agent", RunID: runID},
},
Audience: []string{"my-service"},
TTL: 15 time.Minute,
Caveats: limes.Caveats{
Ops: []limes.Op{limes.OpGet, limes.OpShare},