Add AI agents manually

When you register the AI agent, provide the following details:

• Profile: The name and description of the AI agent.
• Owners (optional): The admins who are responsible for the AI agent's governance and lifecycle management. Okta recommends that you assign at least two owners to an AI agent to ensure that it always has an owner.
• Client registration: The authentication method that the AI agent uses to prove its identity to Okta. This can be a client ID, client secret, or public/private key.
• User access: The app that governs user access to the AI agent. The AI agent can only act on a user's behalf if the user is signed in to the selected app. When an AI agent is bound to an app, the app page displays Linked AI Agent at the top, with a link to the bound AI agent. You can only bind one app to an AI agent.
• Machine access: The apps, services, and other AI agents that can call the AI agent. When you grant machine access to an AI agent, the machine can act on behalf of the AI agent without a user. See Agent-to-agent connections.
  Note: When you grant machine access to another AI agent, Okta automatically creates a resource connection between the two AI agents. For all other callers, you need to configure AI agent resource connections separately.

Before you begin

• You have permission to manage your org's AI agents.
• If you want to bind an AI agent to a SAML app, you've configured it for Cross App Access. See Configure resource server connectors.
• If you want to grant machine access to the AI agent, you've created a custom authorization server. See Create an authorization server. This is required to register the AI agent as a resource that other AI agents and services can call.
• If you want to use the public/private key client registration method, you have a public JSON Web Key (JWK). If you don't have one already, you can generate one when you register the AI agent.

Create a profile

1. In the Admin Console, go to Directory > AI Agents.

2. Click Register AI agent > Register manually.
3. Enter a Name and Description.
4. Click Next.
5. Select a user access setting:
   • Create a new OIDC app linked to this AI agent: Okta creates an OIDC app and binds it to the AI agent.
   • Select an existing SAML app: Select an existing SAML app from the dropdown list.
     Note: This action permanently binds the AI agent to the app. If you need to make a change, delete the AI agent and recreate it.
6. Click Next.

Assign owners (optional)

1. On the Owners tab, click Edit.
2. To assign the AI agent to individuals, select Assign individual owners, and then select up to five owners.
3. To assign the AI agent to a group, select Assign a group owner, and the select a group that has at least two members.
4. Click Save.

Add client registration details

You can stage multiple client registration methods, but you can only activate one method at a time.

1. On the Client registration tab, select a client registration method:
   • Client ID only: Recommended for public clients that can't store a secret, like local coding agents.
   • Client secret: Recommended for server-side AI agents. Click Generate secret and provide it to the AI agent builder or developer.
   • Public/private key: Recommended for AI agents that have builder-managed key pairs.
     1. Click Add public key.
     2. Enter your public key, or click Generate new key. Okta creates a public key that's associated with a private key that you can view in JSON or PEM.
     3. Click Copy to clipboard and store the private key safely.
     4. Click Done.
2. Copy the identifier that appears in the Client ID field and provide it to the AI agent builder or developer.
3. Click Activate.
   Note: If a client registration method is already active, a Switch button appears. If you switch to a different client registration method, the original registration details are disabled, and its details are retained on the Client registration tab.
4. Click Enable on the dialog that appears.
   Note: The AI agent can't use this client registration method until the AI agent builder or developer implements the client secret.
5. To deactivate a client secret or public key, click the vertical ellipses and select Deactivate. To remove it, click the vertical ellipses again and select Delete.

Configure user access

Skip these steps if you configured User access settings when you created the AI agent profile.

1. Go to the User access tab.
2. Select a user access setting:
   • Create a new OIDC app linked to this AI agent: Okta creates an OIDC app and binds it to the AI agent
   • Select an existing app: Select a SAML app from the dropdown list.
   Note: This action permanently binds the AI agent to the app. If you need to make a change, delete the AI agent and recreate it.
3. Click Save.

Configure machine access

Allow non-human callers to access the AI agent as a resource with their own access token.

1. Go to the Machine access tab.
2. To allow non-human identities to call the AI agent, you need to configure a custom authorization server. This is a one-time task. If you've already completed it, skip to the next step. Otherwise, click Configure.
   1. Select an Authorization server from the dropdown list.
   2. Enter the Audience/resource URL that's configured for the authorization server.
      Note:

      The audience URL is the identifier that callers use to request tokens from the AI agent. You can't edit this value later.

   3. Click Save.
3. Click Add caller.
   1. To allow another AI agent to call this AI agent, click AI agent.
      1. Select an AI agent from the dropdown list.
      2. Select Allow all to grant all available OAuth scopes to the AI agent. Or, select Only allow or Disallow and select the scopes that you want to grant or deny the AI agent.
      3. Click Add caller.
   2. To allow an app or service to call the AI agent, click Application or service.
      1. Select an app or service from the dropdown list.
      2. Click Add caller.
4. Repeat the previous step for every caller that you want to add.

Activate an AI agent

You can only activate AI agents that have assigned owners.

1. On the AI agent page, select Actions > Activate.
2. Click Confirm.
3. To deactivate the agent, select Actions > Deactivate