Agents
Agents are OAuth clients registered with AIGW, commonly through Dynamic Client Registration. Each ProjectProjectThe isolation boundary for an integration. It holds Resources, agents and agent policy, end users, and Proxy clients. tracks the agents that have asked for its ResourcesResourceThe downstream system registered in a Project. Its kind (Token exchange or OAuth client) decides the role AIGW plays. and the status each one currently has.
Lifecycle states
Project → Agents expands into four lists, each with a count:
| List | Meaning | Available action |
|---|---|---|
| Pending | Agents awaiting a decision. The authorization server refuses their requests until you approve or reject them. | Approve / Reject |
| Approved | Agents currently allowed to reach the Project's Resources. | Revoke |
| Rejected | Agents that were refused. | — |
| Revoked | Agents whose earlier approval was withdrawn. | — |
Each row shows the agent name and domain, its Verification status (for example Unverified), the Resources it asked for, Decided by (policy when the Agent policy decided automatically, otherwise the person who decided), and when it was last decided.
How agents get a status
An agent's first status is set automatically by the Project's Agent policy. With no policy configured, the system default approves every agent, so new agents land directly in Approved. An agent only appears in Pending when a rule says Hold.
A person's decision always overrides policy: approving, rejecting, or revoking an agent in the ConsoleAIGW ConsoleThe AIGW developer dashboard (DevCon) where you manage Accounts, Projects, Resources, agents, and policies. is never changed by later rule evaluations.
Why approval is separate from user consent
There are two different decisions:
- Project/operator policy: Is this agent allowed to use resources in this Project at all?
- End-user consent: Does this user allow the approved agent to access the requested scopes?
Both can matter. An agent can be technically registered but still blocked by project policy.
Operational guidance
When debugging authorization failures after a successful DCRDCRDynamic Client Registration (RFC 7591): an agent registers itself as an OAuth client at runtime, with no manual setup. request, check the Agent's status early, and check whether an Agent policyAgent policyProject or Resource rules that approve, hold, or reject an agent the first time it asks for a Resource. The default approves everyone. rule is holding or rejecting it. Revoke stops future access by an agent independently of a particular user's consent.