Agents act as themselves: scoped keys, their own upstream accounts, and their own name in audit and usage

An agent is now a principal in its own right rather than something borrowing a person's identity. Agent API keys carry explicit permissions, and two new agent-runtime-safe grants let a key poll its plugins and send hook events without being able to reach anything else. Events an agent reports are attributed to the agent itself: a self-reported email or a cached session identity never re-attributes them to a person. Agents can own upstream accounts directly, with session and grant-generation checks enforced through OAuth and tool execution, and their delegated access is scoped to a selected MCP server while live policy exclusions still apply.

Features

• Agent keys carry explicit, narrow permissions #6405 - Agent API keys can poll agent.getPlugins when the agent holds the new org:device_agent_sync grant, and send hook events when it holds org:hooks_ingest. Both scopes are agent-runtime-safe and registered in delegated-policy version 2. The plugins response includes the agent's principal, and plugins resolve for the agent, its roles, and the organization wildcard. Hook events are attributed to the agent itself, agent sessions are stored without requiring an email, and the OTEL and LiteLLM ingestion endpoints continue to reject agent keys. (Author: @bradcypert)
• Agents own their upstream accounts #6382 - Owned upstream accounts attach to agents with exact session and grant-generation checks enforced throughout OAuth and tool execution. (Author: @danielkov)
• Delegated access scoped to one server #6379 - Agent delegation is scoped to a selected MCP server while live policy exclusions are preserved, and creating or rotating an agent key requires explicit permissions. (Author: @danielkov)
• Agent identity survives into sessions and usage views #6365 - Agent MCP credentials are scoped to live delegable access, agent-owned upstream account bindings are supported, and the agent's identity is preserved in sessions and usage views rather than collapsing into the person who created the key. (Author: @danielkov)
• Durable delegation credentials #6584 - Encrypted OIDC delegation credentials are retained with lazy renewal, bounded consent retry, and sanitized organization-admin status. (Author: @danielkov)

Rolling out

• Workload assertion grant at the MCP token endpoint #6622 - A workload with no client registration exchanges its platform-issued identity token for a session scoped to one named MCP server, available to organizations on the agent authorization rollout. The grant resolves the token's issuer to a trusted workload issuer, verifies it against that issuer's published keys, requires exactly one audience naming the endpoint, refuses a replayed token, admits the subject through the tenant's workload admissions, and requires a live assigned agent. The session has no client and no refresh token and lasts 15 minutes. Every verification or admission failure answers the same invalid_grant; outages answer 503 and rate limits 429, both with Retry-After. (Author: @aa-wong)
• Workload identifiers must use https #6515 - A workload assertion naming a plain-http issuer is untrusted, and an issuer row with a plain-http jwks_uri is refused before any key set is fetched. Assertions whose JOSE typ header marks them as a WIMSE Workload Identity Token or an RFC 9068 access token are rejected outright, since those credentials must never be exchanged as bearer grants. (Author: @aa-wong)