An intent agent is a specialized AI agent that turns a person's natural-language request into a structured intent: a precise, machine-readable statement of who wants to do what, to which resources, and in what context. The IndyKite Intent Agent is an open-source implementation of this idea, built on OpenID AuthZEN semantics, that lets enterprises hold every agent and tool in a workflow to what the person actually asked for.
Why AI agents need a structured intent
Most AI agents act on behalf of a person through delegation. The agent gets its own identity, and the system records who it acts for. On its own, however, delegation hands the agent the full breadth of that person's permissions and passes them down every hop of a multi-agent workflow. A request to view an account balance can, three agents later, still reach a payment tool.
Intent-based access control addresses this by limiting an agent to the task it was given. But a system cannot enforce natural language. A policy engine cannot compare "Can I see the refund docs?" with a tool description. It needs the request expressed in the same terms as the resources it protects, and producing that expression is the job of the intent agent.
How the IndyKite Intent Agent works
The Intent Agent receives a prompt together with the caller's verified identity and returns a structured intent in OpenID AuthZEN terms: a subject, an action or set of actions, resources and context. "Can I see the refund docs?" becomes a subject (this user), an action (read) and a resource (documents of type refund).
Four design choices shape the result. The intent is grounded in the organization's own knowledge graph schema and access policies, so it uses the vocabulary the enterprise's systems already understand. Requests outside the domain an agent was built for are rejected rather than forced into a match. The subject comes from the caller's verified identity, never from the prompt, which protects against attempts to impersonate another user. And every generated intent is written to an audit log, so it can be reproduced and checked later.
The Intent Agent communicates over the Agent2Agent (A2A) protocol and ships as a container image that runs alongside existing infrastructure.
What happens after the intent is captured
Extracting the intent is the only non-deterministic step in intent-based access control (IBAC). AI translates the request once, at the start of the workflow. From that point on, rules make the decisions.
The intent is sealed in a signed token and carried from hop to hop, agent to agent and agent to tool, so every actor in the delegation chain is held to the same request. Each downstream agent may take on a more specific sub-task, but its intent can only match or narrow the original. At the gateway, an IBAC engine compares the intent with the intended usage that agents and MCP servers declare for their skills and tools. Anything that does not fit is removed from the agent's view before it acts. The knowledge graph then decides what data each step may touch, based on relationships and trust.
The IndyKite Intent Agent is available as open source on GitHub, where developers can contribute, open issues and join discussions. Want to learn more? Explore the Intent Agent on Github or read how intent is matched to tools in: Enforcing user intent across AI tool calls.
