Identity and access
Know whose authority is behind the action. Each agent acts under its own identity and its own role. For mediated connections, the credential stays in Oxagen.
Five agents each asked as themselves. A rule denied the release agent's push to main, allowed the bug fixer's tracker update and the triage loop's post, routed the test writer's staging migration to Priya Shah, and routed the hotfix agent's $1,400 refund to two people.
Requests by agent
- Push to mainDenied by rule no-push-mainRelease agent
- Update ENG-219Allowed by rule tracker-writesBug fixer
- Run the staging migrationRouted to Priya ShahTest writer
- Refund $1,400Routed to two people by rule refund.over-1000Hotfix agent
- Post to #releasesAllowed by rule release-notesTriage loop
Agent identity
When three engineers run the same agent under one shared token, the audit log shows the token and nobody behind it. In Oxagen an agent is a principal in its own right, with its own identity and its own role. It does not borrow yours.
Oxagen decides every capability the agent asks for against that role, records the call as the agent's, and bounds it by the person it acts for. An agent cannot receive a role that grants more than the person who assigns it holds. Oxagen refuses that assignment and names the capabilities that overreached.
What an agent request carries
An illustrative request from a coding agent to run a staging migration on behalf of its operator, routed to a named approver by a workspace rule, with the answer still open.
One access request
- Agent
- billing-fixer
- Acting for
- Priya Shah
- Requested action
- Run the staging migration
- Scope
- Staging database
- Rule
- Routed to a person by
migrations.ask - Answer
- Waiting for the approverOpen
Request decisions
- The agent asks
When a task needs a system, a scope, or an action its mandate does not already cover, the agent requests it at the moment of use.
- A rule answers
A workspace rule allows the request, denies it, or routes it to a named person. Stella holds a routed call until the person answers. Codex and Cursor receive a refusal that gives the reason.
- The record keeps the answer
Oxagen records the answer and the rule behind it beside the call, so a reviewer can trace the action back to its authority.
Connection credentials
For mediated connections, Oxagen uses the connection credential on the agent's behalf, and the agent does not receive it. The agent's identity says who acted. The connection credential says which account the action used.
Identity and enrollment paths
| Path | For | How it starts | How it ends |
|---|---|---|---|
| Agent enrollment | A machine running Claude Code, Codex, Cursor, or Stella | A person runs oxagen agent enroll with their CLI login | Revoke one machine, or every machine an agent is enrolled on, with oxagen agent unenroll |
| Machine registration | A machine set up from a coding agent's MCP connection | A one-time enrollment token that expires unused after 30 minutes | The same revocation as agent enrollment |
| Single sign-on | People in the organization | OIDC or SAML 2.0 sign-in, with SCIM 2.0 to create people, on the Enterprise plan | SCIM removal from Okta or Microsoft Entra ID |
Default for a new agent
In scope
- Every new agent starts with the Agent Contributor role. It reads freely, makes low and medium risk changes, and has high-risk requests routed to a person first.
- MCP tools need first-use consent under that role.
- Agent role checks run on every plan.
Out of scope
- A capability the person assigning the role does not hold.
- A credential for a connection Oxagen does not mediate, which the agent may still hold itself.
Product walkthrough
Review one access request and the authority behind its answer.