Agent identities (beta)

An agent sends the access token its identity provider issued to POST https://intertrace.fly.dev/v1/auth/agent-token (an RFC 8693 token exchange: subject_token plus your organization id as org_id or the X-Intertrace-Org-Id header) and gets back an Intertrace runtime key, at most an hour long and never past the token's own expiry, bound to the Intertrace agent you mapped its identity to. The agent then uses that key like any runtime key.

• The token is checked only against the issuers your organization trusts and has turned on.
• Signature with the issuer's published keys (RS256 or ES256 only), exact iss, an allowed aud, exp required; Entra tokens must also carry your tenant id.
• The agent identity must be mapped to an agent of your organization that is connected to the runtime. Nothing is created.
• The person the agent acts for names a member only when the issuer vouches for an address that belongs to exactly one member; anyone else is recorded as an outside person, never an approver.

1. 1

   Add the issuer

   Settings → Identity → Agent identities (owners and admins): pick Microsoft Entra Agent ID (tenant id), Okta for AI Agents (the custom authorization server's issuer URL) or another OAuth 2.0 issuer (issuer and JWKS URL), and the audiences your tokens carry.
2. 2

   Map your agents

   Map each agent id in the token (Entra: the agent identity's app id, azp/appid; Okta: act.sub; others: the outermost act.sub, else client_id) to an Intertrace agent.
3. 3

   Turn it on

   A new issuer starts off. Turn it on in the list once its agents are mapped.

Turning an issuer off or removing it revokes every live key its agents already exchanged a token for, so their calls are refused at once. Every change is in the audit log (delegated_authority_issuer_saved, delegated_authority_issuer_removed), and every exchange or refusal too.