Agents become first-class identities with their own credentials, policies, and owners

An AI agent no longer has to borrow a person's API key. The platform can now hold an agent as a principal in its own right: a human owner creates it, grants it an allow-only runtime policy narrower than their own, issues it API keys with a required expiry, and can suspend, rotate, transfer, or revoke it. Every request an agent makes is admitted against three live policies at once, the immutable grant it was delegated, its own direct policy, and its current owner's policy, so an agent can never do more than the person accountable for it. If that owner leaves the organization, the agent is blocked until an admin explicitly reassigns it. Agent credential issuance is rolling out per organization behind the gram-agent-credentials-m2 flag.

Features

• Create and manage agent principals #6047 - Human-only APIs and a setup page for creating, renaming, suspending, resuming, revoking, and deleting first-class agents. Owners manage identity and lifecycle without extra grants, other people are checked against exact agent:* permissions, and every transition writes its before-and-after audit event in the same transaction. (Author: @danielkov)
• Agent API keys with delegated grants and bounded expiry #6071 - Issue, list, rotate, and revoke API keys for an agent through the existing keys API. Each key carries an immutable delegated policy, the identity of the human who authorized it, a required expiry, and a one-time secret. Issuance, listing, and rotation are behind the per-organization gram-agent-credentials-m2 flag; revocation always works. (Author: @danielkov)
• Every agent request is admitted against live policy #6068 - Agent credentials are checked on every call against the delegated grant, the agent's direct policy, and the current owner's policy together, and malformed, expired, inactive-parent, or owner-ineligible requests are rejected. Telemetry and audit records name the agent as the actor while keeping its authorizer and owner as separate provenance. (Author: @danielkov)
• MCP sessions for agent subjects #6072 - Agents can hold MCP sessions using the same challenge, token, refresh, and revocation machinery people use. The live parent and delegated policy are re-checked on every access and refresh, and a replayed refresh is denied once its successor session has been revoked. (Author: @danielkov)
• Direct agent policies, allow-only by design #6051 - Owners and people holding agent:write can create, update, and delete an agent's direct runtime policy. Only allow rules from the agent-safe scope registry are accepted, so this surface cannot write a deny rule, a reusable role, or another principal's grants. (Author: @danielkov)
• Owner loss blocks the agent until it is reassigned #6053 - When an owner is deleted, deactivated, or removed from the organization, the agent latches into a blocked state that survives the owner regaining eligibility. Explicit transfer by the current owner, or reassignment by an admin, is the only way out, and both preserve the agent's identity and direct policy. (Author: @danielkov)
• Agent management capabilities in custom roles #6041 - Four new capabilities, agent:read, agent:write, agent:authorize, and agent:transfer, are added to new organization-admin roles and exposed in the custom role editor under an Agents group, kept separate from the runtime scopes an agent itself may hold. (Author: @danielkov)

Bug fixes

• Typed agent policy selectors #6077 - Create and update request bodies preserve typed policy selectors, and the dashboard API client contracts are regenerated to match. (Author: @danielkov)