OCAP Bounded Authority: Edera's Managed Approach to Object Capabilities

Edera argues that AI agents make ambient authority especially risky: a filesystem permission, cloud identity, GitHub token, or sudo access gives a compromised workload more power than its immediate task may require. Prompt injection, malicious tools, or software vulnerabilities can then turn that broad access into a security incident. Object-capability security takes the opposite approach: a workload has no authority unless it receives an explicit, unforgeable reference that designates a resource and permits a particular action. Edera calls its product-level version “bounded authorities” - capabilities deliberately limited by resource, operation, identity, or other constraints. The security boundary is what the agent can do, not whether its behavior can be trusted.

In Edera’s proposed architecture, a broker keeps credentials and uses them to carry out requests on an agent’s behalf; the agent receives only a constrained capability, not a reusable secret. Its capcurl concept applies this model to HTTP APIs, allowing limits on items such as destination, endpoint, method, request shape, identity, and rate. Capsudo applies it to privileged local commands: an agent might be allowed to restart one service without receiving general root access. Capabilities can be combined to give an agent the specific authorities it needs, such as checking Git status, restarting a payment service, or opening a pull request for one repository. Edera presents this as a way to reduce the impact of agent compromise while making permissions more explicit and auditable.