Feature proposal/discussion: enable end-to-end Agent Access through PATs, answer-cli, and an Answer Skill

[hgaol]

Is your feature request related to a problem? Please describe

There is no consistent, least-privilege way for CLI tools and coding agents to operate as an existing Answer user while preserving the user account permissions, moderation rules, CAPTCHA behavior, and the ability to revoke access.

Describe the solution you would like

Discuss an Agent Access design based on Personal Access Tokens, answer-cli, and an Answer Agent Skill.

The initial PAT scopes are:

• question.read
• question.create
• answer.read
• answer.create
• vote.write

This is an initial scope set and may be extended in future releases as additional workflows are defined.

The complete design, including authentication, authorization, token lifecycle, CLI behavior, Skill behavior, security considerations, and delivery phases, is documented in Agent Access Design.

This issue is intended for design review and discussion before implementation is expanded.

Related issue: #1555

Describe alternatives you have considered

• Continue using administrator-managed API keys, which do not represent an individual Answer user and are not suitable for least-privilege user delegation.
• Add agent-specific identities or a separate agent API, which would introduce new identity, attribution, and authorization models.
• Use unrestricted browser automation or ad hoc HTTP scripts, which would not provide a stable CLI contract or explicit revocation and scope controls.

[hgaol]

I'll provide the draft design and POC.

[hgaol]

The draft PR is open for design review and discussion, with POC code: #1615. You can check docs/agent-access.md in PR for the detailed design. link

To try the current branch:

git clone --branch agentic-exp https://github.com/hgaol/answer.git /tmp/answer-agentic-exp
cd /tmp/answer-agentic-exp

# Install the Answer skill from this branch
npx skills add . --skill answer --agent '*' --copy -y

# Install answer-cli from this branch
go install ./cmd/answer-cli

# Ensure Go-installed binaries are on PATH
export PATH="$(go env GOPATH)/bin:$PATH"

# Verify
answer-cli version

The branch currently provides proof-of-concept code for the CLI/Agent Access direction. Please use the draft PR and this issue to discuss the design before treating it as production-ready.