Delegated, Revocable Access with Per-User MCP Sessions

Delegated access for an AI agent means the runtime gets a scoped, time-limited credential — not your workspace API key. Naïve mints this as an MCP session: a bearer token and URL bound to one tenant user, filtered by their Account Kit, with a TTL you control and instant revoke. Every call still routes through the governance gateway — caps, approvals, audit unchanged.

This is the pattern MCP clients (Claude Desktop, Cursor, custom agents) need when you can't trust the runtime with long-lived secrets.

Why long-lived keys fail for agents

Your workspace key (nv_sk_…) is root access. Hand it to an agent loop, an MCP client, or a customer's hosted runtime and you inherit every failure mode at once: prompt injection exfiltration, log leakage, a bug that scopes the wrong tenant, no way to cut off one customer without rotating for everyone.

Sessions invert the model: mint the minimum credential for the minimum time, for one user, revocable without collateral damage.

How a session is created

const session = await naive.forUser(alice.id).sessions.create({
  ttlMs: 15 * 60 * 1000,
});
 
// Hand to your MCP client:
// session.mcp.url + session.mcp.headers

The response includes an MCP SSE URL and an Authorization: Bearer nv_sess_… header. The token never appears in the URL — only in headers — so proxies and access logs don't capture it.

A Naïve MCP session (sessions.create) has a default TTL of 15 minutes and a maximum of 24 hours, is scoped to one tenant user, and is instantly revocable (per published docs).

What the session can do

The session's tool list is the fused native + third-party toolset for that user, filtered by their Account Kit. If the kit disables cards, the session can't reach cards — regardless of what the model asks for. AI agent permissions explains kit enforcement.

Multi-tenant primitives (connections, vault, logs) default to the session's tenant user, so a session minted for Alice cannot list Bob's vault entries.

How revoke works

await naive.forUser(alice.id).sessions.revoke(session.id);

Revoke is immediate — the MCP connection is rejected on the next request. Use this when:

• A customer's contract ends mid-session.
• You detect anomalous tool-call patterns.
• A runtime you don't control should lose access now, not in 14 minutes when TTL expires.

For revoking the entire agent profile (not just one session), see how to revoke an AI agent's access instantly.

Sessions vs agent profiles

In multi-tenant SaaS, you mint a session per customer runtime, not one session for the whole app.

BYO runtime + sessions

The lead adoption path: keep your LangGraph / Eve / custom loop, inject governed tools from the agent profile, authenticate the MCP connection with a session instead of the workspace key:

const op = await naive.forUser(tenant.id).provision("support", { idempotencyKey: `op:${tenant.id}` });
const session = await naive.forUser(tenant.id).sessions.create({ ttlMs: 900000 });
// Point MCP client at session.mcp — tools are governed; key is not exposed

Hosted vs bring-your-own runtime compares where the loop runs; governance is identical either way.

Where to start

Pick one untrusted runtime — a local MCP client, a customer's cloud worker — and replace the workspace key with a session. Set a 15-minute TTL, wire revoke into your offboarding flow, and confirm the Account Kit filters the tool list. The sessions docs are the source of truth.