Protected resources

Protected resources represent the MCP servers, APIs, and other services that OAuth2/OIDC clients can request access to through Strivacity.

A protected resource identifies the target of an authorization request and defines the scopes available for that resource. Strivacity can then issue access tokens for the resource and control which clients can request its scopes.

For Agentic AI use cases, protected resources represent the services that AI agents access on behalf of customers.

How protected resources work

Each protected resource has a resource URL that identifies it during OAuth2 authorization. Clients request access to the resource using this URL and one or more of its configured scopes.

Protected resources are assigned to OAuth2/OIDC clients. An assignment determines which resources and scopes a client can request.

When a client requests access:

1. The client identifies the protected resource and the scopes it needs.
2. Strivacity checks that the resource and scopes are available to the client.
3. When customer authorization is required, Strivacity presents the requested access to the customer.
4. After successful authorization, Strivacity issues an access token for the requested resource and scopes.

The protected resource is identified in the access token audience, allowing the receiving service to determine whether the token was issued for it.

Resource types

Delegated access protected resources can use one of the following types:

• Generic protected resource: An API or other OAuth2-protected service.
• MCP server: A Model Context Protocol server.

Both types use the same protected resource model. Selecting MCP server identifies the resource as an MCP server and makes it available from Agentic AI > MCP servers in the Admin Console.

Scopes

Scopes describe the permissions available for a protected resource.

Each scope has a technical name used in OAuth2 requests and a customer-facing display name that can be shown when the customer is asked to authorize access.

The protected resource defines the scopes that are available. When the resource is assigned to a client, you select which of those scopes the client can request and whether customer authorization is required.

If a client later requests additional access that requires authorization, Strivacity can ask the customer to authorize the additional scopes.

Protected resources and AI agents

AI agents access protected resources through OAuth2/OIDC clients.

An AI agent can be assigned one or more protected resources and the scopes it is allowed to request for each resource. The same protected resource model can also be used with OAuth2/OIDC clients that are not AI agents.

MCP servers configured as protected resources are also listed under Agentic AI > MCP servers, providing a dedicated view for MCP-based Agentic AI integrations.

Configure protected resources

Protected resources are configured under Policies > Protected resources.

See Protected resources policy for information about creating and managing protected resources, defining scopes, assigning resources to clients, and enabling, disabling, or deleting protected resources.

For developer guidance on using Strivacity as the authorization server for an MCP server, see Integrating an MCP server with Strivacity.

Where to go next

• Protected resources policy: Configure and manage protected resources.
• AI agents: Configure clients used by AI agents.
• Authorization consents: Learn how customers authorize and revoke access.
• Integrating an MCP server with Strivacity: Integrate an MCP server with Strivacity authorization.