Projects
A ProjectProjectThe isolation boundary for an integration. It holds Resources, agents and agent policy, end users, and Proxy clients. is the practical isolation boundary for an integration. It contains ResourcesResourceThe downstream system registered in a Project. Its kind (Token exchange or OAuth client) decides the role AIGW plays., Agents and agent policy, End Users, Proxy clientsProxy clientThe server-side credential (client ID and secret) the MCP/UCP service uses to authenticate itself to AIGW. Never give it to an agent., and project-level team membership.
Create a Project
Go to Project Management → New Project and give it a name such as Production, a merchant name, or another boundary meaningful to your operations. The name is the only input; you can rename the Project later with the pencil icon next to its name.
The created Project shows its name, a copyable Project ID, and a project sidebar:
| Sidebar item | What it contains |
|---|---|
| Team | Who can reach this Project |
| Resources | Downstream systems registered in the Project (see Resources) |
| Agents | Pending / Approved / Rejected / Revoked lists plus the Agent policy pages — How it works, Domain rules, Approval rules, KYA issuers (see Agents and Agent policy) |
| End Users | People your agents have acted on behalf of at this Project's Resources, filterable by Resource |
| Proxy clients | Server credentials for the MCP/UCP backend (see Proxy clients) |
| Dangerous operations | Delete project — permanently deletes the Project and all its data |
Why the Project boundary matters
Credential redemptionCredential redemptionPOST /api/credentials/token: the MCP/UCP service trades the user's AIGW token plus its Proxy token for the merchant access token. requires the AIGW user token and proxy tokenProxy tokenA short-lived token the MCP/UCP service gets with its Proxy client, sent as X-Proxy-Token when redeeming a merchant token. to belong to the same Project. A Proxy client from Project A cannot redeem a user's token from Project B.
Agent decisions and Agent policy also live here, so separate Projects can maintain independent approval rules and allow/reject decisions for agents.
Project team
Project roles observed are Admin, Developer, and Viewer. Project members must already be members of the AccountAccountThe top-level AIGW tenant. It owns Projects, team membership, enabled identity providers, billing, and API keys.; account roles appear as Inherited.
Use Projects to represent an operational/security boundary, not merely a cosmetic grouping.