An agent is registered, acts for a named person, and carries a credential of its own, never a shared service account.
- credentialA credential of its own (agt_…), shown once. Or none at all: see federated identity below.
delegationIts authority is a subset of what the person holds, and it expires. A delegation can only tighten, never widen.
Its authority is a subset of what the person holds, and it expires. A delegation can only tighten, never widen.
oversightDerived from its risk level: autonomous, human in the loop, or human approve. The supervised modes need a person's decision at the moment of each governed action.
Derived from its risk level: autonomous, human in the loop, or human approve. The supervised modes need a person's decision at the moment of each governed action.
DPoPAgent tokens are sender-constrained: bound to a key the agent holds, so a stolen token is useless without it.
Agent tokens are sender-constrained: bound to a key the agent holds, so a stolen token is useless without it.
Agents do their riskiest work when they call tools. The MCP gateway puts the authorization engine between your agent and every tool server.
Tool gateway/api/v1/mcp/servers, /api/v1/mcp/call/*
What it isAuthorizes your agents' outbound calls to your MCP tool servers: each tools/call is authorized, budgeted and logged before it leaves.
Platform MCP serverPOST /api/v1/mcp
What it isAn agent operating the platform itself over MCP. Agent tokens only.
MCP authorization server/api/v1/oauth/*
What it isMints audience-bound tokens that your own MCP server verifies.
Tools are allowlisted with a reviewed risk score from 1 to 20, and a tool that only reads can be marked read-only. A tool that is not on the list cannot be called, or even seen, by an agent. Per-agent call caps apply per minute and per day, and the upstream host must also be permitted by the deployment's egress allowlist: two independent chokepoints, both controlled by an administrator.
curl -X POST -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
-d '{"name": "github", "upstream_url": "https://mcp.example.com/rpc",
"max_calls_per_minute": 30, "max_calls_per_day": 500}' \
https://auth.zynthmedia.com/api/v1/mcp/serversFor the supervised modes, every governed action needs a decision when the agent attempts it: a request and an approve or deny, not a standing grant.
- 01The agent calls a governed endpoint. If its oversight mode needs a person, the call is denied with
403and a structured detail. The pending request is registered once: retries return the same request id. - 02The agent polls its own request. It can always read its own asks, with no extra permission.
- 03Once the status is
approved, the agent retries the original call. The approval is for that one act.
{
"detail": {
"message": "Human approval required: command:read",
"approval_request_id": "3f2c…",
"approval_status": "pending"
}
}An action your own executor performs (a shell command, a push, a deploy) asks the platform first through the act endpoint, and its request lands in the same queue. The surface is enabled per installation; when it is off, supervised agents are simply denied governed actions (fail-closed).
An agent in your editor can open an organization on your behalf and configure its IAM: roles, resource permissions, invitations and an SSO scaffold.
The human is always the owner. The agent never sets or sees a human credential, and everything it does is audited from birth. The handshake borrows the shape of the device grant: the agent parks a request and polls while a person approves out of band. Until that approval, the organization is quarantined.
curl -X POST https://auth.zynthmedia.com/api/v1/onboard/bootstrap \
-H "Content-Type: application/json" \
-d '{
"organization_name": "Acme Robotics",
"human_email": "founder@acme.example",
"client_info": {"name": "claude-code", "platform": "cli"},
"manifest": { "manifest_version": 1, "roles": [] }
}'The same agent that holds an identity can be stopped from a pager, and what it did can be read back.
Kill switchPOST /api/v1/agents/{id}/kill-switch refuses the agent at authentication on every surface. A holder of agents:kill can engage it, including an API key; releasing it is human-only.
POST /api/v1/agents/{id}/kill-switch refuses the agent at authentication on every surface. A holder of agents:kill can engage it, including an API key; releasing it is human-only.
- ContainmentAn agent that exhausts its budget is contained automatically, and the platform tells the operator.
Journal and undoEvery write an agent made is journalled. Rollback replays the journal in reverse, and reports what was restored, what was skipped and what could not be undone.
Every write an agent made is journalled. Rollback replays the journal in reverse, and reports what was restored, what was skipped and what could not be undone.
- AuditEvery action is a hash-chained audit entry that carries the hash of the one before it.