Phantom
by Vanish Labs

As Martin Casado points out: authentication is solved, but authorization is a mess. Developers spend months building custom permission logic across dozens of data models, subscription tiers, and team roles.

The Traditional Way: Manual Hell

// Developers write this 1000x times
async function bookFlight(user, details) {
  if (!user.isSubscribed) throw Error();     // Auth check
  if (user.credits < 10) throw Error();      // Permission check
  if (details.price > user.maxSpend) throw Error(); // Policy
  if (!isIntentValid(user.currentTask, "book_flight")) throw Error();
  // ... hundreds more manual checks ...
}

The Phantom Way: Invisible

// One decorator handles everything
@Phantom.Protect({ intent: 'travel_booking' })
async function bookFlight(details) {
  // If execution reaches here, Phantom has ALREADY verified:
  // ✓ Identity (who is the agent?)
  // ✓ Permissions (what can they do?)
  // ✓ Intent (does this align with the mission?)
  // ✓ Entitlements (billing, credits, subscription)
}