Most AI-to-system setups share one master account, which quietly erases who really did what. Aggrete can now carry each person's own access all the way to the upstream, so nobody reaches more than they personally should, and the record names them.
When you connect an assistant to a real system, the usual shortcut is a single service account: one API key, one login, shared by everyone. It is convenient, and it removes the thing security depends on. The HR system sees a generic robot, not Sam. The logbook cannot say who asked. And that robot usually has broad access, so a person reaches things they never could on their own.
The right answer is on-behalf-of: each request reaches the upstream with the caller's own credential and their own permissions. In 0.7 that is a one-line switch, per connector.
Mark an upstream per_user: true and point it at a hook that resolves each person's credential, your vault or a token-exchange script:
# proxy.config.yaml upstreams: drive: command: python3 args: [-m, aggrete.connectors.drive, --root, Northwind] per_user: true obo: command: [/opt/aggrete/obo.sh] # prints {"env": {...}} or {"headers": {...}}
The hook runs once per (person, connector) with the caller's identity in the environment, and returns the credential to use. Aggrete merges it into a connection opened just for that call. A static map of users works too, and with no hook at all the caller's identity is passed as AGGRETE_ACTING_USER, so a delegation-aware connector can act as them.
Aggrete does not forward the person's login token to the upstream. It resolves a separate credential through your hook, so the proxy stays the only road to the connector and the confused-deputy problem stays closed. A per-user connector opens a fresh connection per call for isolation; shared connectors keep one long-lived session. Every decision records who the call acted as.
Per-user access joins the deterministic controls added recently: tool-integrity checks against rug-pulls and poisoned tool descriptions, an inbound-secret block, per-user rate limits, the prompt-injection egress shield, and SIEM-ready audit. Together they make Aggrete the place where individual identity and a code of conduct meet, in front of every tool call, with no model in the decision path.
pip install aggrete then aggrete --demo for the interactive walkthrough. To wire per-user access to your own systems, see the Per-user access section in the README, or start with the beginner's guide.Aggrete is Apache-2.0 and runs on a laptop or a cluster. Star it, fork it, and tell us what rule to build next.