UnYOLO Introduces Credential Broker and Policy Engine for GitHub and Other Services

Introducing UnYOLO

UnYOLO is a new framework that functions as a credential broker and proxy for various online services, including GitHub, Hugging Face, and Google Workspace. Its core purpose is to enhance security by ensuring that agents do not directly possess the real credentials for these services. Instead, agents communicate with the UnYOLO broker, which then handles authentication and authorization.

Policy Enforcement and Granular Control

The framework allows users to define fine-grained access policies within a local JSON file. This approach eliminates the need for clicking through permission screens or creating separate accounts for agents. Policies can specify which operations an agent is permitted to perform, and on which resources. For situations requiring temporary elevated access, UnYOLO supports timed grants that automatically expire.

Enhanced Security Model

Traditional agent tools often operate with account-wide tokens, which can pose a security risk if a mistaken command affects multiple repositories. UnYOLO addresses this by keeping the provider token in a separate process. Agents receive a client credential whose authority is derived from the defined policy, meaning unauthorized actions, such as a force-push to a protected branch, will fail before reaching the service provider.

Operational Flow

When an agent requests an operation, the broker identifies the client and the requested action. This information is then matched against the rules defined in the JSON policy file. If an operation is not explicitly allowed by policy, it can be flagged for operator approval. The broker executes approved operations using the provider's credential and returns only the result to the agent, logging decisions without exposing sensitive information.