AgentID Policy Builder

Agent

ID Name Owner Environment Expires at Default JIT TTL

Purpose

Require OIDC tokens Token validation Issuer Audience JWKS URI Tenant claim

Require job boundary Require job_id Allowed jobs Out of scope Bind fields

Job boundaries prevent scope drift when a tool is allowed in general but not for this case or customer.

Include MCP gateway mapping Mode Provider Downstream server

The generated mapping derives AgentID fields from MCP tool arguments such as job_id, case_id, and customer_id.

May call agents Require approval Allowed agents Delegated tools Max depth Approval agents