Hey Product Hunt 👋 Agents stopped being single scripts and became fleets. Orchestrators create sub-agents at runtime, each alive for minutes, each wired into real systems. Almost nothing governs them. One API key shared by everything, all-or-nothing tool access, server code downloaded fresh on every launch, and the only record of what happened written by the agent itself. Chancery is the identity layer for that. Following one agent's life: Identity. Registered, owned by a named human, and fingerprinted (prompt, config, tool list), so "did this change since review?" becomes a comparison rather than a meeting. The agent, its version, and each running copy are separately revocable. Access that only narrows. Permissions are signed and delegated downward, and a child can only hold a subset. Revoke any link and everything beneath it dies on its next action. Widening simply cannot be expressed. Safe runtime spawning. This is the multi-agent piece most stacks skip. A human approves a template once, capping capability and lifetime. Orchestrators then create workers on the fly with no admin credentials: each gets its own identity, a narrower slice of the parent's access, the parent's owner attached so accountability can't be laundered, and an expiry that shuts it out automatically. Both directions secured. Requests are checked live, and anything an agent can't do is hidden from the model rather than refused. The tool server is fingerprinted and re-verified before every run. Change one file in its dependencies and it won't start. You can also install servers frozen instead of pulling them fresh, restrict them to named destinations, make their filesystem read-only, and run them as a separate user. Secrets agents never hold. Encrypted at rest and handed only to the tool server as it starts, so a prompt injection can't leak what was never in context. Rotation is one update with no agent changes. Browser agents work the same way: a human's session is custodied on their behalf, and every page the agent visits is checked against what it's allowed to reach. Revocation that lands. Cut access and the next action fails, mid-session. Servers that opt in can check with Chancery right before committing, so a revocation arriving mid-flight prevents the action instead of documenting it afterwards. That part needs the server to cooperate, and the docs say so. Evidence, not logs. Tamper-evident, so any edit or reorder is detectable, and physically unable to hold prompts or payloads. There's also a read-only dashboard with a live timeline and the delegation chain drawn as a tree. Adoption is a one-line change to how you already launch tool servers. It governs non-MCP agents too (LangGraph, CrewAI, cron jobs) through the same decision API. All 17 known limitations are published with owners and timelines. Last week someone on Reddit showed that one of our credential-isolation claims was weaker than stated. He was right. It's now a numbered gap with his handle on it, and the fix shipped the next day. Apache-2.0, self-hosted, no cloud, no telemetry. brew install chanceryhq/tap/chancery More useful than an upvote: tell me where it breaks. 🔗 chanceryai.vercel.app ⭐ github.com/chanceryhq/chancery

Chancery

The identity provider for AI agents

The identity provider for AI agents