Question 1

What is may_act_grants and how does delegation work?

Accepted Answer

SharkAuth expresses delegation policy as structured data. Every grant is scoped to specific actions, resources, and time windows, and can be revoked or expired automatically when conditions change.

Question 2

How does DPoP protect against token theft?

Accepted Answer

Every access token is cryptographically bound to the agent's private key via RFC 9449 DPoP. A stolen token is useless without the key, making replay attacks impossible by design.

Question 3

What is act chain depth and why does it matter?

Accepted Answer

SharkAuth preserves the complete delegation chain across every agent hop. When agent A delegates to B who calls API C, the full provenance is surfaced in token introspection, eliminating 'the agent did it' dead ends.

Question 4

How fast is cascade revocation?

Accepted Answer

Revoke any grant and every downstream token invalidates automatically. The change is indexed by grant_id and propagated through introspection in under 12 ms p99.

Question 5

Can SharkAuth run offline or on edge devices?

Accepted Answer

Yes. It ships as a single static Go binary with embedded SQLite WAL. Deploy it next to your app, in a container, on a corporate VM, or an air-gapped edge. Or drop it on a $5 VPS. Backup is a single file copy.

Question 6

What audit capabilities does SharkAuth provide?

Accepted Answer

Structured JSON audit logs, indexed by grant_id, subject, actor, and grant. Stream directly to your SIEM via events websocket. Compliance-ready out of the box.

The Shark Logs.

The DPoP Revolution

SharkAuth v0.1.0: Auth for the Agent Era