Caracal is an open source authority layer for AI agents. Give agents authority instead of credentials with policy-based authorization, least-privilege delegation, instant revocation, human approvals, and tamper-evident audit. Supported by GitHub, Microsoft, Vercel, and LFX Mentorship under Linux Foundation Decentralized Trust (LFDT).

Thanks for checking out Caracal! As AI agents move from answering questions to taking real actions, we noticed that most production systems still rely on long-lived credentials, shared service accounts, and custom authorization logic. That works initially, but becomes difficult to scale as more agents, tools, and integrations are added. Caracal is our attempt to solve this with an open source authority layer for AI agents, giving agents authority instead of credentials through policy-based authorization, least-privilege delegation, instant revocation, human approval workflows, and tamper-evident audit. We're actively looking for: * Engineering teams building production AI agents. * Design partners willing to share feedback. * Open source contributors interested in security, authorization, AI infrastructure, and distributed systems. If you're building agentic products, we'd genuinely love to hear how you're solving authorization and governance today. Your feedback will directly influence the project's roadmap. Thanks for taking a look, and feel free to ask any questions or share your thoughts.

The revocation feature is genuinely impressive, I tested flipping a policy mid-task and the agent stopped immediately. Way more practical than the usual credential sprawl most teams still rely on.

Caracal

Give AI agents authority, not credentials.

Give AI agents authority, not credentials.