Skip to main content

​
Establish authority

  1. Create the agent in the intended organization and environment.
  2. Register an OAuth machine client and link it to that agent.
  3. Register its public JWK and complete proof of possession. Keep the private key outside the portal, in the workload’s protected configuration or signing service.
  4. Obtain approval for the exact resource and required scopes.
  5. Configure MachineAgent.from_env() and verify a request to that resource.
Use the quickstart for the complete process configuration. A linked client without an approved grant has no resource authority.

​
Manage changes

Request only the scopes needed by the workload. If its resource or scope set changes, update the approved grant and configure the client with the intended identity. For key replacement, use the client’s key management and proof-of-possession flow. See Signing key changes. Suspension and containment can prevent new access. An existing token may still be accepted by an offline verifier until expiry. Live enforcement depends on the resource integration. An enforcement hold requires an authorized restore; changing an agent status alone must not bypass containment. Use the same setup in sandbox and production, with the appropriate environment configuration.