Agentic AI
Customers increasingly use AI agents to interact with services on their behalf, from checking balances to managing bookings and other account activity. Strivacity's Agentic AI capabilities let you make MCP servers and APIs available to those agents using standards-based OAuth 2.0 authorization.
Customers remain in control of the access they grant, while your brand controls which resources and scopes an agent can request.
Strivacity's Agentic AI support focuses on two situations:
- External agents accessing your MCP servers and APIs: Agents your customers choose and operate, such as personal assistants or other third-party AI tools.
- Agents serving your customers or partners: Agents operated by your brand or a partner to perform tasks on behalf of customers.
In both cases, Strivacity can authenticate the customer and act as the authorization server for the protected resource the agent wants to access.
The building blocks
Agentic AI access in Strivacity is built from OAuth2/OIDC clients, protected resources, and customer authorization.
- AI agent: An OAuth2/OIDC client with the AI agent client subtype. Configure the client with the protected resources and scopes the agent is allowed to request.
- Protected resource: The MCP server, API, or other service the agent wants to access. A protected resource defines its resource URL, available scopes, and customer-facing information used during authorization.
- Authorization consent: The customer's approval for an agent or other application to access a protected resource on their behalf. Customers can review and revoke their authorized access in My Account.
- Dynamic clients: Support agents whose client information is provided dynamically instead of creating each client manually.
How authorization works
Agentic AI access uses the same standards-based OAuth2 authorization model as other delegated access.
A typical authorization works as follows:
- The agent starts an OAuth2 authorization request and identifies the protected resource it wants to access.
- Strivacity verifies that the client is allowed to request the resource and scopes.
- Strivacity authenticates the customer using the login journey and policies configured for the application.
- When customer authorization is required, Strivacity presents the requested access to the customer.
- After successful authorization, Strivacity issues an access token for the requested resource and scopes.
- The agent presents the access token to the protected resource when it performs an authorized action.
Resource Indicators for OAuth 2.0 (RFC 8707) let the client identify the resource it wants to access. Strivacity uses the protected resource URL to restrict the access token to the intended resource.
If an agent later requests additional access that requires customer authorization, Strivacity can ask the customer to authorize the additional scopes.
Configuration
Agentic AI configuration brings together an application, an OAuth2/OIDC client, and the protected resources the agent needs to access.
- Configure the protected resource. Register the MCP server, API, or other service the agent needs to access. Define its resource URL and the scopes available for the resource, including customer-facing scope descriptions used during authorization.
- Configure the agent client. Create an OAuth2/OIDC client with the AI agent subtype. Assign the protected resources the agent can access and select the scopes the client is allowed to request for each resource. For external agents that register dynamically, configure client registration and the client configuration that registered agents use.
- Configure customer authorization. For the scopes assigned to the client, determine which access requires customer authorization. Customer-facing resource and scope information is used to explain the requested access during the authorization journey.
- Integrate the protected resource. Configure the MCP server or API to accept access tokens issued by Strivacity and validate that a token was issued for the intended resource and includes the permissions required for the requested operation.
- Test the authorization. Run an authorization using a test customer account. Verify that the expected resource and scopes are requested, the customer is presented with authorization when required, and the resulting access token can be used with the protected resource.
Manage agent access
In the Admin Console, select Agentic AI from the left-hand navigation to access Agentic AI-related configuration from one place.
Agent access continues to use the same underlying OAuth2/OIDC client and protected resource configuration available elsewhere in the Admin Console. The Agentic AI area brings these related entities together for easier management.
From Agentic AI, you can work with:
- AI agents: View and manage OAuth2/OIDC clients configured with the AI agent subtype.
- MCP servers: View and manage protected resources configured as MCP servers.
- Client registration: Configure support for dynamically registered clients.
Customers can review and revoke access granted to agents and other applications from My Account.
Administrators can also disable or remove agents and protected resources when access should no longer be available.
Monitor adoption
Dashboard widgets provide visibility into customer adoption of AI agents.
Use these to review:
- How many active accounts have authorized at least one agent.
- How many distinct agents customers have authorized, including agents used by more than one customer.
- How agent authorizations are being added and removed over time.
- How the total number of agent authorizations changes over time.
Standards support
| Capability | Standard |
|---|---|
| Authorization and token issuance | OAuth2 authorization code flow with PKCE |
| Authorization server discovery | OIDC Discovery |
| Resource targeting and audience restriction | Resource Indicators for OAuth 2.0 (RFC 8707) |
| Agent registration | Manual registration and Client ID Metadata Documents (CIMD). See Dynamic clients. |
Where to go next
Updated 8 days ago