# Agent access and records for security teams | Oxagen

Source: https://oxagen.sh/roles/security

# Security

Know whose authority is behind the action. Review how each agent's identity maps to its role, how Oxagen holds the credential for a mediated connection, and what each routed action records.

[Follow work from its source to its outcome](https://oxagen.sh/#demo)

Four requests routed through Oxagen. A rule allowed reading the repository, routed a $1,200 refund to Priya Shah, denied deleting a repository, and routed a push to the release branch to Sam Chen.

Requests and the rule that answered each

*   **Read oxageninc/product**Allowed by rule repo.read
*   **Refund $1,200 on inv\_8Q2**Routed to Priya Shah by rule refund.over-1000
*   **Delete repository oxageninc/docs**Denied by rule repo.delete
*   **Push to release/4.11**Routed to Sam Chen by rule release-branch

Illustrative A rule answers each request routed through Oxagen

01

## The request model

Each agent in Oxagen has its own identity and its own role. It does not borrow the identity of the person who runs it. Oxagen seeds three agent roles: Agent Observer reads and changes nothing, Agent Contributor routes high-risk changes to a person, and Agent Operator may make high-risk changes except to source control, billing, and secrets.

The run's record names the agent that asked, the person it acted for, the rule that answered, and who approved the call when a person was required, beside its result and cost. This covers actions routed through Oxagen.

02

## Controls your team owns

Who changes each control
| Control | What it does | Who changes it |
| --- | --- | --- |
| Kill switch | Denies tool calls on a tool, server, connection, agent, operator, workspace, or the organization at the next call boundary | Organization Owner |
| Auto-approval rules | Let a call a policy sent to a person go ahead without one under set conditions, with the calls each rule released and held in the last 30 days | Organization Owner |
| Agent role | Sets what an agent may change, never past the grants of the person who assigns it | Organization Owner |
| Spend ceiling | Denies runs over a period's limit for the organization or one workspace | Organization Owner or Compliance and Billing member, or a workspace Admin for that workspace |

03

## Kill switch coverage

### In scope

*   Tool calls a governed agent run makes
*   External tools the tool gateway serves
*   Steering tools served to a wrapped agent

### Out of scope

*   Oxagen's in-app agent, which has its own switch
*   A capability called with an API key against the API or MCP server, which IAM and key revocation govern

04

## Credential custody

For mediated connections, Oxagen uses the connection credential on the agent's behalf. The agent does not receive that credential. Oxagen encrypts each stored credential before it writes it to the database, and switching off a connection revokes its live credential grants.

Custody covers the connection. A person or a tool can still paste a secret into a prompt as content.

05

## Export and audit log

An organization Owner exports a finished run as a locked file an auditor checks offline. The file states which actions its record could not see. Role changes, sign-ins, and access decisions sit in the security log.

06

## Pages for this review

*   [
    
    ### Identity and access
    
    Each agent's identity and the roles behind it.
    
    ](https://oxagen.sh/product/mandates/identity)

## Related pages

*   [
    
    ### Identity and access
    
    Each agent has its own identity
    
    ](https://oxagen.sh/product/mandates/identity)

## Product walkthrough

Bring an access-review question and inspect the rule and recorded answer.

[Follow work from its source to its outcome](https://oxagen.sh/#demo)