Workday Is Buying Identity for AI Agents. Let's Build a Tiny Access Grant in TypeScript.

npx tsx access-grant.ts 

// tiny-access-grant: lifecycle-bound access for registered AI agents. // A small model of the idea. Not how Workday or C1.ai work inside. // Agents, roles, systems, scopes and times are example inputs. No network. No API key. type System = "email" | "crm" | "repo" | "finance" | "cloud"; type Status = "active" | "ended"; interface Agent { id: string; owner: string; // the person accountable for this agent role: string; status: Status; } interface Grant { agentId: string; system: System; scopes: string[]; reason: string; grantedAt: number; // minutes since midnight on a fake clock expiresAt?: number; revokedAt?: number; revokeReason?: string; } interface Decision { allow: boolean; reason: string; } interface AuditEvent { at: string; kind: "register" | "grant" | "reject" | "check" | "revoke" | "role" | "end"; agentId: string; detail: string; } // The most each role may hold. A grant can be smaller, never bigger. const ROLE_CEILING: Record<string, Partial<Record<System, string[]>>> = { "sales-assistant": { email: ["read", "send"], crm: ["read", "update"] }, "revops-analyst": { crm: ["read"], finance: ["read"] }, "support-triage": { email: ["read"], crm: ["read"] }, }; const hhmm = (t: number) => `${String(Math.floor(t / 60)).padStart(2, "0")}:${String(t % 60).padStart(2, "0")}`; 

// Step 1: the agent system of record interface Store { now: number; agents: Map<string, Agent>; grants: Grant[]; audit: AuditEvent[]; } function newStore(start = 9 * 60): Store { return { now: start, agents: new Map(), grants: [], audit: [] }; } function log(s: Store, kind: AuditEvent["kind"], agentId: string, detail: string): void { s.audit.push({ at: hhmm(s.now), kind, agentId, detail }); } function register(s: Store, id: string, owner: string, role: string): Agent { if (s.agents.has(id)) throw new Error(`${id} is already registered`); if (!ROLE_CEILING[role]) throw new Error(`unknown role ${role}`); const agent: Agent = { id, owner, role, status: "active" }; s.agents.set(id, agent); log(s, "register", id, `owner=${owner} role=${role}`); return agent; } 

// Step 2: grants that live inside the role function isLive(g: Grant, now: number): boolean { return g.revokedAt === undefined && (g.expiresAt === undefined || now < g.expiresAt); } function grant( s: Store, agentId: string, system: System, scopes: string[], reason: string, ttlMinutes?: number, ): Grant | undefined { const agent = s.agents.get(agentId); const ceiling = agent ? ROLE_CEILING[agent.role][system] ?? [] : []; const extra = scopes.filter((x) => !ceiling.includes(x)); const why = !agent ? "not registered" : agent.status !== "active" ? "agent has ended" : !reason.trim() ? "no reason given" : extra.length ? `${system}.${extra.join(",")} is above role ${agent.role}` : ""; if (why) { log(s, "reject", agentId, `${system} [${scopes}]: ${why}`); return undefined; } for (const old of s.grants) { if (old.agentId === agentId && old.system === system && isLive(old, s.now)) { revoke(s, old, "replaced by a new grant"); } } const g: Grant = { agentId, system, scopes, reason, grantedAt: s.now, expiresAt: ttlMinutes === undefined ? undefined : s.now + ttlMinutes, }; s.grants.push(g); const until = g.expiresAt === undefined ? "" : ` until ${hhmm(g.expiresAt)}`; log(s, "grant", agentId, `${system} [${scopes}]${until}: ${reason}`); return g; } function revoke(s: Store, g: Grant, why: string): void { g.revokedAt = s.now; g.revokeReason = why; log(s, "revoke", g.agentId, `${g.system}: ${why}`); } 

// Step 3: check on every action function checkAccess(s: Store, agentId: string, system: System, action: string): Decision { const d = decide(s, agentId, system, action); log(s, "check", agentId, `${system}.${action} ${d.allow ? "ALLOW" : "DENY"}: ${d.reason}`); return d; } function decide(s: Store, agentId: string, system: System, action: string): Decision { const agent = s.agents.get(agentId); if (!agent) return { allow: false, reason: "not in the system of record" }; if (agent.status !== "active") return { allow: false, reason: `agent ${agent.status}` }; const mine = s.grants.filter((g) => g.agentId === agentId && g.system === system); const live = mine.find((g) => isLive(g, s.now)); if (!live) { const last = mine.at(-1); if (!last) return { allow: false, reason: `no ${system} grant` }; if (last.revokedAt !== undefined) { return { allow: false, reason: `revoked ${hhmm(last.revokedAt)}, ${last.revokeReason}` }; } return { allow: false, reason: `expired ${hhmm(last.expiresAt!)}` }; } if (!live.scopes.includes(action)) { return { allow: false, reason: `scope ${action} not in [${live.scopes}]` }; } return { allow: true, reason: live.reason }; } 

// Step 4: lifecycle events move access function changeRole(s: Store, agentId: string, role: string): void { const agent = s.agents.get(agentId); if (!agent || agent.status !== "active") throw new Error(`${agentId} is not active`); if (!ROLE_CEILING[role]) throw new Error(`unknown role ${role}`); log(s, "role", agentId, `${agent.role} -> ${role}`); agent.role = role; for (const g of s.grants) { if (g.agentId !== agentId || !isLive(g, s.now)) continue; const ceiling = ROLE_CEILING[role][g.system] ?? []; const keep = g.scopes.filter((x) => ceiling.includes(x)); if (keep.length === g.scopes.length) continue; revoke(s, g, `role changed to ${role}`); if (keep.length) grant(s, agentId, g.system, keep, `${g.reason} (trimmed for ${role})`, remaining(g, s.now)); } } function remaining(g: Grant, now: number): number | undefined { return g.expiresAt === undefined ? undefined : g.expiresAt - now; } function endAgent(s: Store, agentId: string, why: string): void { const agent = s.agents.get(agentId); if (!agent || agent.status === "ended") return; agent.status = "ended"; log(s, "end", agentId, why); for (const g of s.grants) { if Source：https://dev.to/bobbyhalljr/workday-is-buying-identity-for-ai-agents-lets-build-a-tiny-access-grant-in-typescript-25m4
My favorites