Security
Know whose authority is behind the action. Review how each agent's identity maps to its role, how Oxagen holds the credential for a mediated connection, and what each routed action records.
Four requests routed through Oxagen. A rule allowed reading the repository, routed a $1,200 refund to Priya Shah, denied deleting a repository, and routed a push to the release branch to Sam Chen.
Requests and the rule that answered each
- Read oxageninc/productAllowed by rule repo.read
- Refund $1,200 on inv_8Q2Routed to Priya Shah by rule refund.over-1000
- Delete repository oxageninc/docsDenied by rule repo.delete
- Push to release/4.11Routed to Sam Chen by rule release-branch
The request model
Each agent in Oxagen has its own identity and its own role. It does not borrow the identity of the person who runs it. Oxagen seeds three agent roles: Agent Observer reads and changes nothing, Agent Contributor routes high-risk changes to a person, and Agent Operator may make high-risk changes except to source control, billing, and secrets.
The run's record names the agent that asked, the person it acted for, the rule that answered, and who approved the call when a person was required, beside its result and cost. This covers actions routed through Oxagen.
Controls your team owns
| Control | What it does | Who changes it |
|---|---|---|
| Kill switch | Denies tool calls on a tool, server, connection, agent, operator, workspace, or the organization at the next call boundary | Organization Owner |
| Auto-approval rules | Let a call a policy sent to a person go ahead without one under set conditions, with the calls each rule released and held in the last 30 days | Organization Owner |
| Agent role | Sets what an agent may change, never past the grants of the person who assigns it | Organization Owner |
| Spend ceiling | Denies runs over a period's limit for the organization or one workspace | Organization Owner or Compliance and Billing member, or a workspace Admin for that workspace |
Kill switch coverage
In scope
- Tool calls a governed agent run makes
- External tools the tool gateway serves
- Steering tools served to a wrapped agent
Out of scope
- Oxagen's in-app agent, which has its own switch
- A capability called with an API key against the API or MCP server, which IAM and key revocation govern
Credential custody
For mediated connections, Oxagen uses the connection credential on the agent's behalf. The agent does not receive that credential. Oxagen encrypts each stored credential before it writes it to the database, and switching off a connection revokes its live credential grants.
Custody covers the connection. A person or a tool can still paste a secret into a prompt as content.
Export and audit log
An organization Owner exports a finished run as a locked file an auditor checks offline. The file states which actions its record could not see. Role changes, sign-ins, and access decisions sit in the security log.
Pages for this review
Product walkthrough
Bring an access-review question and inspect the rule and recorded answer.