Register Your Agent Identity and Configure Access Policies

1. Register your AI agents.

   Registering an agent creates a persistent Agent ID and issues the OAuth 2.1 client credentials the agent uses to authenticate to the AI Gateway.

   1. In Strata Cloud Manager, go to AI SecurityAI IdentityAgent Identities.
   2. Click Register Agent Identities.

   3. Complete the registration fields:

      Field	Description
      Agent Name	A unique display name for the agent. Names must be unique within your tenant.
      Description	A brief description of what the agent does.
      Framework	Select the agent framework (for example, LangChain, AutoGen, CrewAI, or other).
      Redirect URL	The callback URL the agent listens on for the OAuth redirect after user authentication. For agents deployed in the cloud, this is the agent's publicly accessible callback endpoint. For agents running locally during development, this is typically http://localhost:<port>/callback.
      Owner Email	(Optional) Assign an owner by selecting a user from your connected IdP directory in Idira. As you type, the field displays an autocomplete list of user identities sourced from the connected directory.
      Team	(Optional) Enter a team name.
      Workspace Access	Select the AI Gateway workspace this agent will operate within. The agent can access MCP servers registered in the same workspace. Multiple workspaces can be selected.

   4. Click Register Agent.
   5. Click Copy All to Clipboard to copy the generated credentials.

      On successful registration, the system assigns a globally unique Agent ID (UUID) and generates OAuth 2.1 client credentials: a client_id and a client_secret.

      The client_secret is displayed only once, at registration time. Copy and store it immediately in your organization's secrets manager (for example, AWS Secrets Manager or Azure Key Vault). If you lose the secret, you must delete the agent and register it again.
2. Configure your AI agent application with the registration credentials.

   After saving the credentials from the registration screen, you must make them available to your agent application:

   • In development environments, you can store them in a local .env file or configuration JSON but never commit secrets to source control.
   • Store credentials in your organization's secrets manager and inject them into your agent at runtime via environment variables or a secrets-fetch call.

   Your agent code must be configured to:

   • Use the client_id as the OAuth client identifier.
   • Use the client_secret at the AI Gateway's token endpoint to complete the OAuth 2.1 authorization code flow.
   • Send requests through the AI Gateway endpoint (not directly to the MCP server). The Gateway URL uses a slug-based path format: https://<your-gateway-domain>/mcp/<mcp-server-slug>.

   Once configured, launch your agent and initiate a request. In your browser you are redirected to the URL advertised by the Gateway. In this process, the browser is redirected to Idira, which federates to your enterprise IdP (such as Okta or Microsoft Entra ID) for user sign-in. You may also be redirected to the MCP server's authorization server if it uses an OAuth 2.1 authorization code flow. At the end of the flow, the agent receives an authorization code from the Gateway, which it exchanges for an access token from the Gateway to complete authentication before routing the request to the target MCP server.

   For an AI agent to access an MCP server on behalf of a user, all three entities the Agent Identity, the Target MCP Server, and the User must be assigned to the same Workspace in the AI Gateway:

   1. Verify MCP Registry Setup: In Strata Cloud Manager, go to AI Gateway > Integrations > MCP Registry.
   2. Assign Workspaces: Verify that your target MCP server is assigned to the workspace where both your registered agent and delegating user reside.
   3. Tool Capabilities & OAuth Metadata: The MCP server entry defines available tools (which can be toggled on/off individually) along with its underlying backend execution URL and OAuth metadata.
   4. Default Access Control Policies:Access permissions across users, agents, and MCP servers within a workspace are governed by the AI Gateway's policy engine. Ensure appropriate access policies are configured to grant runtime execution rights for the user-agent pair.
3. Configure access policies to govern agent tool access.

   Access policies control which users, acting through which agents, may call which MCP server tools. Policies are enforced by the AI Gateway at runtime on every MCP request.

   1. In Strata Cloud Manager, go to AI GatewayAgent IdentityPoliciesManage AI Gateway.

   2. Click Add Access Policies to create a new policy, or click an existing policy to edit it.

   3. In the Agents section, search for and attach the target agents.

   4. In the Users and User Groups section, select specific users or user groups, or select Apply to Any User.

   5. In the MCP Authorization section, click Add Target MCP Servers & Tools, select the target MCP servers registered in the workspace, and configure the allowed tool execution scopes (allow all or restrict specific tools).

   6. Click Add Access Policy (or Save Changes for existing policies) to publish the policy to the AI Gateway data plane.