An agent's identity page now tells you whose credential is actually making each call, not just who set the connection up once. The Activity tab shows every connection grant and what a permission change actually touched, and agent owners and editors can now open an agent's sessions without full admin access. More on this in Agent identity.

Features

• Agent pages show who they're acting on behalf of #8563 - The agent page now shows, per MCP server, whose credential signed each call, or that it's a shared credential, instead of "Authorized by" the key's issuer. Tool calls made with an agent API key no longer record the key's issuer as the person the agent acted for. (Author: @mfbx9da4)
• The Activity tab shows what a permission change actually touched #8612 - An agent's Activity tab now shows when someone grants it a connection or removes it, and names what each permission change touched, for example "mcp:connect · Acme Ops" instead of only "Added direct policy grant to agent." (Author: @mfbx9da4)
• Agent owners and editors can read an agent's sessions #8564 - Members with agent:write on an agent can now list and open that agent's sessions read-only, and the dashboard shows them its Sessions panel. (Author: @mfbx9da4)
• GitHub Actions workload identity adds a pull-request-only job type #8469 - The GitHub Actions setup offers a fourth job type, Pull requests, admitting only pull-request jobs that use no environment and refusing branch, tag, and environment jobs; forked pull requests get no token. This is rolling out behind the GitHub Actions workload-platform flag. (Author: @subomi)

Bug fixes

• An assistant's sessions now show under the agent it acts as #8537 - An agent that an assistant acts as now lists the assistant's sessions on its identity Overview and Sessions tabs, and in Agent Sessions filtered to that agent, instead of showing none. (Author: @mfbx9da4)
• Agent identity pages load faster #8682 - Agent identity pages no longer send one MCP server activity request per project; a new endpoint returns recent activity for every readable project in a single request, and the agents roster stops loading people-only data it never shows. (Author: @adaam2)