Grant an agent exactly the resources and actions it needs for its task — and nothing else.
A warrant lists what's allowed as least-privilege caveats: resource patterns (globs like mcp:github/acme/*), an allowed action set (read, pay), and limits. Everything not granted is denied — and unknown caveat types fail closed, so a warrant can never accidentally permit more than it says.
caveats: [
{ type: 'resource', patterns: ['mcp:github/acme/*', 'db:prod/reports'] },
{ type: 'action', actions: ['read'] },
]When the agent delegates, scope can only shrink. A sub-agent handling one repo gets a warrant for that repo alone — even though its delegator could see many.
Liceat is permission infrastructure for AI agents. You issue a warrant — a scoped, spend-capped, revocable token — that grants an agent narrow authority; the agent presents it at the point of action; Liceat enforces it (scope, spend, rate, holder-binding, revocation) and records every decision in a tamper-evident log. It is open source with a zero-dependency SDK for TypeScript and Python.
The SDK and self-hosted gateway are free and open source. The hosted gateway at liceat.com gives 10,000 free decisions with no card, then meters at fractions of a cent per decision — payable by card or USDC.
Free to self-host. 10,000 free decisions on the hosted gateway — no card.
Get an API key Read the docs