# AI agent identity and access | Oxagen

Source: https://oxagen.sh/product/mandates/identity

# Identity and access

Know whose authority is behind the action. Each agent acts under its own identity and its own role. For mediated connections, the credential stays in Oxagen.

[Follow work from its source to its outcome](https://oxagen.sh/#demo)[Read the Mandates overview](https://oxagen.sh/product/mandates)

Five agents each asked as themselves. A rule denied the release agent's push to main, allowed the bug fixer's tracker update and the triage loop's post, routed the test writer's staging migration to Priya Shah, and routed the hotfix agent's $1,400 refund to two people.

Requests by agent

*   **Push to main**Denied by rule no-push-mainRelease agent
*   **Update ENG-219**Allowed by rule tracker-writesBug fixer
*   **Run the staging migration**Routed to Priya ShahTest writer
*   **Refund $1,400**Routed to two people by rule refund.over-1000Hotfix agent
*   **Post to #releases**Allowed by rule release-notesTriage loop

Illustrative Each request carries the agent that asked

01

## Agent identity

When three engineers run the same agent under one shared token, the audit log shows the token and nobody behind it. In Oxagen an agent is a principal in its own right, with its own identity and its own role. It does not borrow yours.

Oxagen decides every capability the agent asks for against that role, records the call as the agent's, and bounds it by the person it acts for. An agent cannot receive a role that grants more than the person who assigns it holds. Oxagen refuses that assignment and names the capabilities that overreached.

02

## What an agent request carries

An illustrative request from a coding agent to run a staging migration on behalf of its operator, routed to a named approver by a workspace rule, with the answer still open.

One access request

Agent

billing-fixer

Acting for

Priya Shah

Requested action

Run the staging migration

Scope

Staging database

Rule

Routed to a person by `migrations.ask`

Answer

Waiting for the approverOpen

Illustrative Fields an access request carries in Oxagen

03

## Request decisions

1.  **The agent asks**
    
    When a task needs a system, a scope, or an action its mandate does not already cover, the agent requests it at the moment of use.
    
2.  **A rule answers**
    
    A workspace rule allows the request, denies it, or routes it to a named person. Stella holds a routed call until the person answers. Codex and Cursor receive a refusal that gives the reason.
    
3.  **The record keeps the answer**
    
    Oxagen records the answer and the rule behind it beside the call, so a reviewer can trace the action back to its authority.
    

04

## Connection credentials

For mediated connections, Oxagen uses the connection credential on the agent's behalf, and the agent does not receive it. The agent's identity says who acted. The connection credential says which account the action used.

05

## Identity and enrollment paths

How people and agents get an identity
| Path | For | How it starts | How it ends |
| --- | --- | --- | --- |
| Agent enrollment | A machine running Claude Code, Codex, Cursor, or Stella | A person runs `oxagen agent enroll` with their CLI login | Revoke one machine, or every machine an agent is enrolled on, with `oxagen agent unenroll` |
| Machine registration | A machine set up from a coding agent's MCP connection | A one-time enrollment token that expires unused after 30 minutes | The same revocation as agent enrollment |
| Single sign-on | People in the organization | OIDC or SAML 2.0 sign-in, with SCIM 2.0 to create people, on the Enterprise plan | SCIM removal from Okta or Microsoft Entra ID |

06

## Default for a new agent

### In scope

*   Every new agent starts with the Agent Contributor role. It reads freely, makes low and medium risk changes, and has high-risk requests routed to a person first.
*   MCP tools need first-use consent under that role.
*   Agent role checks run on every plan.

### Out of scope

*   A capability the person assigning the role does not hold.
*   A credential for a connection Oxagen does not mediate, which the agent may still hold itself.

## Related pages

*   [
    
    ### Mandates
    
    The terms an agent works under
    
    ](https://oxagen.sh/product/mandates)
*   [
    
    ### Security
    
    Agent identity and recorded decisions
    
    ](https://oxagen.sh/roles/security)

## Product walkthrough

Review one access request and the authority behind its answer.

[Follow work from its source to its outcome](https://oxagen.sh/#demo)[Read the Mandates overview](https://oxagen.sh/product/mandates)