{"slug": "biscuit", "name": "Biscuit", "category": "databases", "category_name": "Databases", "description": "", "recommenders": 4, "commenters": 6, "warners": 0, "score": 3.992, "rising": 0.02, "first": "2025-11-09", "latest": "2026-10-15", "why": "You could reduce (maybe remove) the central keys management using Biscuits.", "why_is_quote": true, "has_verdict": false, "sentiment": {"recommend": 4, "neutral": 3, "compare": 1, "warn": 0}, "spark": [0, 2, 0, 0, 0, 0, 0, 0, 1, 0, 0, 1], "listed": true, "loved": [], "caveat": "", "short_quote": "You could reduce (maybe remove) the central keys management using Biscuits.", "kind": "", "icon": true, "domain": "eclipse.org", "github_repo": null, "official_url": "https://www.biscuitsec.org", "pricing": "", "aliases": ["Biscuit", "biscuit"], "verdict": null, "praise": [{"label": "", "summary": "", "quotes": [{"id": 801607776, "item_id": 50100486, "url": "https://news.ycombinator.com/item?id=50100486", "by": "mceleri", "date": "2026-10-15", "version": null, "stance": "recommend", "quote": "You could reduce (maybe remove) the central keys management using Biscuits.", "excerpt": "You could reduce (maybe remove) the central keys management using Biscuits. I wrote a similar idea here: https://github.com/mceleri/attenuated-agent-budgets Is different because my point is to use fiat payments, but the Biscuits attenuation logic should work great also for your case, with the orchestrator that can split a budget for his sub-agents on his side, without (ora at least reducing) API calls.", "context": "", "use_case": "attenuated agent budget tokens", "switched_from": "", "story": "Show HN: MoneySwitch \u2013 AI agents pay x402 APIs in USDC (self-hosted)"}, {"id": 783102736, "item_id": 48943921, "url": "https://news.ycombinator.com/item?id=48943921", "by": "meling", "date": "2026-07-16", "version": null, "stance": "recommend", "quote": "There is Biscuit from OSDI 2018", "excerpt": "There is Biscuit from OSDI 2018 https://pdos.csail.mit.edu/projects/biscuit.html", "context": "", "use_case": "", "switched_from": "", "story": "Solod: Go can be a better C"}, {"id": 742007728, "item_id": 46375483, "url": "https://news.ycombinator.com/item?id=46375483", "by": "smarx007", "date": "2025-12-24", "version": null, "stance": "recommend", "quote": "And https://projects.eclipse.org/projects/technology.biscuit", "excerpt": "And https://projects.eclipse.org/projects/technology.biscuit", "context": "", "use_case": "", "switched_from": "", "story": "Permission Systems for Enterprise That Scale"}]}], "caveats": [], "who": [], "tags": [], "use_cases": ["attenuated agent budget tokens", "capability tokens", "authorization tokens"], "compared": [], "makers": [{"id": 745253584, "item_id": 46578349, "url": "https://news.ycombinator.com/item?id=46578349", "by": "sp1982", "date": "2026-01-11", "version": null, "stance": "neutral", "quote": "Just a fun experimental tsdb completely written by codex.", "excerpt": "https://github.com/syamp/biscuit - Just a fun experimental tsdb completely written by codex.", "context": "", "use_case": "experimental time-series database", "switched_from": "", "story": "Ask HN: What Are You Working On? (January 2026)"}], "threads": [{"url": "https://news.ycombinator.com/item?id=46577242", "title": "Ask HN: What Are You Working On? (January 2026)", "mentions": 2}, {"url": "https://news.ycombinator.com/item?id=50099082", "title": "Show HN: MoneySwitch \u2013 AI agents pay x402 APIs in USDC (self-hosted)", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=48895199", "title": "Solod: Go can be a better C", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=47741527", "title": "Ask HN: What Are You Working On? (April 2026)", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=46374117", "title": "Permission Systems for Enterprise That Scale", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=46289884", "title": "Biscuit is a specialized PostgreSQL index for fast pattern matching LIKE queries", "mentions": 1}], "sentiment_by_month": {"2025-11": {"neutral": 1}, "2025-12": {"compare": 1, "recommend": 2}, "2026-01": {"neutral": 1}, "2026-02": {}, "2026-03": {}, "2026-04": {"neutral": 1}, "2026-05": {}, "2026-06": {}, "2026-07": {"recommend": 1}, "2026-08": {}, "2026-09": {}, "2026-10": {"recommend": 1}}, "versions": [], "version_unnamed": 0, "family_ref": null, "runs_on": null, "lines": [], "quotes": [{"id": 801607776, "item_id": 50100486, "url": "https://news.ycombinator.com/item?id=50100486", "by": "mceleri", "date": "2026-10-15", "version": null, "stance": "recommend", "quote": "You could reduce (maybe remove) the central keys management using Biscuits.", "excerpt": "You could reduce (maybe remove) the central keys management using Biscuits. I wrote a similar idea here: https://github.com/mceleri/attenuated-agent-budgets Is different because my point is to use fiat payments, but the Biscuits attenuation logic should work great also for your case, with the orchestrator that can split a budget for his sub-agents on his side, without (ora at least reducing) API calls.", "context": "", "use_case": "attenuated agent budget tokens", "switched_from": "", "story": "Show HN: MoneySwitch \u2013 AI agents pay x402 APIs in USDC (self-hosted)"}, {"id": 783102736, "item_id": 48943921, "url": "https://news.ycombinator.com/item?id=48943921", "by": "meling", "date": "2026-07-16", "version": null, "stance": "recommend", "quote": "There is Biscuit from OSDI 2018", "excerpt": "There is Biscuit from OSDI 2018 https://pdos.csail.mit.edu/projects/biscuit.html", "context": "", "use_case": "", "switched_from": "", "story": "Solod: Go can be a better C"}, {"id": 763967330, "item_id": 47747958, "url": "https://news.ycombinator.com/item?id=47747958", "by": "ymyms", "date": "2026-04-12", "version": null, "stance": "neutral", "quote": "It's built using biscuits", "excerpt": "I'm making capability security for distributed systems. The primitives and engine are both open source. Primitives: https://github.com/Hessra-Labs/hessra-tokens Engine: https://github.com/Hessra-Labs/hessra-cap It's built using biscuits and written in rust. I'm really into it. Using capability security as a model makes building things feel like they snap together a lot more naturally. At least for me. I've also got a", "context": "", "use_case": "", "switched_from": "", "story": "Ask HN: What Are You Working On? (April 2026)"}, {"id": 745273905, "item_id": 46579619, "url": "https://news.ycombinator.com/item?id=46579619", "by": "ymyms", "date": "2026-01-11", "version": null, "stance": "neutral", "quote": "capability-style tokens using biscuits", "excerpt": "I'm working on https://www.hessra.net/ We've built a new auth platform with some new identity primitives and capability-style tokens using biscuits. Right now, I'm trying to figure out ways to apply it and am looking into offering integrations with extremely fine-grained access control that wouldn't have it otherwise. So adding a fine-grained access layer in front of stuff like backend-for-frontend (BFF) systems, bro", "context": "", "use_case": "Capability tokens", "switched_from": "", "story": "Ask HN: What Are You Working On? (January 2026)"}, {"id": 742007728, "item_id": 46375483, "url": "https://news.ycombinator.com/item?id=46375483", "by": "smarx007", "date": "2025-12-24", "version": null, "stance": "recommend", "quote": "And https://projects.eclipse.org/projects/technology.biscuit", "excerpt": "And https://projects.eclipse.org/projects/technology.biscuit", "context": "", "use_case": "", "switched_from": "", "story": "Permission Systems for Enterprise That Scale"}, {"id": 741430752, "item_id": 46339422, "url": "https://news.ycombinator.com/item?id=46339422", "by": "maxmcd", "date": "2025-12-20", "version": null, "stance": "recommend", "quote": "", "excerpt": "I found some more info here: https://biscuit.readthedocs.io/en/latest/benchmark_roaring.html", "context": "", "use_case": "", "switched_from": "", "story": "Biscuit is a specialized PostgreSQL index for fast pattern matching LIKE queries"}, {"id": 740331153, "item_id": 46270697, "url": "https://news.ycombinator.com/item?id=46270697", "by": "niyikiza", "date": "2025-12-14", "version": null, "stance": "compare", "quote": "Closest to Macaroons/Biscuit, but adapted for workflows where delegation happens dynamically mid-task.", "excerpt": "I've been spending weekends thinking about authorization for AI agents, specifically delegation. The failure mode I keep hitting: once you give an agent tools, it gets ambient authority over all of them. There's no clean way to say \"for this task, read-only on the reports table\" or \"spin up no more than 3 VMs.\" When the agent spawns sub-agents mid-execution, they inherit full access by default. IAM doesn't help much.", "context": "", "use_case": "", "switched_from": "", "story": "Ask HN: What Are You Working On? (December 2025)"}, {"id": 733910177, "item_id": 45869386, "url": "https://news.ycombinator.com/item?id=45869386", "by": "ymyms", "date": "2025-11-09", "version": null, "stance": "neutral", "quote": "an authorization system based on the Biscuit token format", "excerpt": "Building https://www.hessra.net/, an authorization system based on the Biscuit token format (decentralized, signed, and attenuable). The goal is to push beyond JWTs and Zanzibar-style policy engines by giving every machine-to-machine request its own embedded, verifiable authorization logic in a small capability token. These tokens can be delegated, restricted, and verified locally with no extra network calls required", "context": "", "use_case": "authorization tokens", "switched_from": "", "story": "Ask HN: What Are You Working On? (Nov 2025)"}]}