Agents & identity
Every agent in TaskGate is registered, owned and identified. It acts only with credentials TaskGate issues, and only within the authority it was given.
Register an agent
On Agents, Register an agent asks for:
- Name and Purpose — what it's for.
- Workspace and a Slug used in APIs.
- An optional Risk profile that drives how hard the gate holds it: Data sensitivity, Autonomy, Impact and Reversibility.
- Optional Non-goals — things it must never do, one per line.
You wire up its tools, model and knowledge next, on the agent's own page. An agent can only request the tools it declares; anything else is refused.
Lifecycle
An agent moves through draft, testing, approved and active. An active agent can be suspended and resumed, or deprecated and then retired. A suspended agent's actions are refused.
Credentials
Agents authenticate with short-lived credentials issued by TaskGate. A credential lasts ten minutes unless a shorter or longer lifetime is requested, never more than one hour, and never longer than the grant behind it. When an agent acts for a person, the credential records who.
Credentials can be revoked, and a revocation can cover a wider scope at once.
Delegated authority
A person can grant an agent delegated authority to act within a defined scope. Authority can be passed on again, but each step can only narrow it — a delegation that would widen the parent's scope is rejected. The gate checks the whole chain on every decision; an invalid or revoked chain means refuse.
Separation-of-duties rules stop the same person from holding roles that should stay apart, such as asking for an action and approving it.
People and sign-in
People sign in through your organisation's identity provider. User accounts and groups can be provisioned from your directory with SCIM. When a person leaves, the authority they granted is revoked or suspended pending review, and active agents they owned with a medium or higher risk class are suspended.