Keep credentials out of prompts
Design connections so provider secrets do not need to enter agent code or model context.
Agent AccessIn design
Design agent access that does not put provider credentials in the model loop.
We are exploring governed connections from agents to external providers: who authorized the connection, what the agent may do, how long access lasts, and how a person revokes it. This is separate from protecting your own MCP server.
Delegate deliberately
Represent the person, agent, resource, scope, and approval behind an action.
Make access expire
Prefer narrow, short-lived access over durable credentials copied between systems.
Product scope
External provider access, with the human still in control.
Agent Access is in design, not a generally available feature. Today’s implemented agent-facing foundation is MCP Authorization for customer-owned resources; external-provider credentials, autonomous agent principals, and broader delegation remain roadmap work.
- Governed provider connections
- User-to-agent delegation records
- Short-lived tool credentials
- Resource and scope boundaries
- Approval and revocation controls
- Actor-aware audit evidence
In design