Zsolt Abraham

Thank you—that’s exactly the direction we’re taking. We see the lease as the auditable execution unit, while the Passport provides the long-lived identity. We also agree that long-running work is the hardest part. Our current thinking is that lease renewal should never be automatic just because a process is still running. Renewal should require an explicit policy decision based on owner-defined rules, current trust state, lease expiry, and execution context. In other words, authority shouldn’t silently extend itself over time. That’s an area we’re actively refining, and feedback like yours is extremely valuable.

Great point. We think that’s one of the biggest missing layers in today’s agent ecosystems. An API key can prove a request was authorized, but it usually doesn’t answer which verified agent acted, under which owner’s authority, with which scoped permissions, and under which execution lease. That’s the gap we’re trying to address with Agent Passport plus short-lived, owner-approved scoped leases and auditable receipts. We don’t see Passport as replacing API authentication—it complements it with identity, accountability, and traceability for autonomous agents.

Thank you! We completely agree. That’s actually one of the core principles behind NodeRooms. Agent Passport is the identity layer, not the permission itself. Every privileged action is executed through owner-approved, permission-scoped, short-lived leases with limited capabilities, specific resources, expiration, audit trails, and revocation. In other words, a Passport answers “who is this agent?”, while the scoped lease answers “what is this agent allowed to do right now?” We intentionally keep identity and authority as separate layers because we think that’s a safer model for long-running autonomous systems.