AI agents

An AI agent in Strivacity is an OAuth2/OIDC client with the AI agent client subtype. AI agent clients use Strivacity's standard OAuth2/OIDC authorization capabilities together with protected resources and authorization consents.

AI agent clients can be configured manually, while external agents that provide their client configuration through Client ID Metadata Documents (CIMD) are handled as dynamic clients.

Create an AI agent

Like other OAuth2/OIDC clients, an AI agent belongs to an Application and uses that Application's journeys and policies.

You can create an AI agent from either:

• Agentic AI > AI agents > Create. Select the Application the agent belongs to before configuring the client.
• An Application's Clients tab. Select Create and choose an AI agent client from the client type catalog.

Two AI agent client types are available:

• OIDC using no-code components (AI agent): Uses Strivacity's hosted login and authorization experience.
• OIDC using the Journey Flow API (native, AI agent): Uses the Journey Flow API to integrate the authorization experience into a native client.

After selecting the client type:

1. Enter a Name and, optionally, a Description to identify the client to brand administrators.
2. Configure the OAuth2/OIDC properties required by the agent, such as its callback URLs and token endpoint authentication method.
3. Configure the customer-facing name and logo used to identify the agent during authorization.
4. Assign the protected resources the agent can request access to.
5. Select the scopes the agent is allowed to request for each protected resource and configure whether customer authorization is required.
6. Configure any additional token and client settings required by your integration.
7. Save the client.

Protected resource access

Protected resources define the MCP servers, APIs, and other services an AI agent can request access to.

For each AI agent client, assign the protected resources it is allowed to access and select the permitted scopes. Authorization requests are limited to resources and scopes available to that client.

AI agent clients use the resource URLs of their assigned protected resources to identify the intended token audience. This supports resource-specific access using Resource Indicators for OAuth 2.0 (RFC 8707).

When authorization is required for a requested scope, Strivacity presents that access to the customer as part of the authorization experience.

Customer-facing agent information

Configure a display name and logo that customers can use to recognize the agent.

This information can be presented when customers authorize access and when they review access granted to agents and applications in My Account.

Use names and images that clearly identify the agent to the customer rather than internal client or implementation names.

Manage AI agents

Go to Agentic AI > AI agents to view AI agent clients across your Applications.

Selecting an agent opens its OAuth2/OIDC client configuration, where you can update its settings, protected resource assignments, and status.

You can disable an AI agent client when you need to stop it from being used without removing its configuration. Delete the client when it should no longer be available.

AI agents that use CIMD do not create individual persistent client records and are managed through the dynamic client configuration instead.

Where to go next

• OAuth2/OIDC properties setup: Configure the standard OAuth2/OIDC properties used by AI agent clients.
• Protected resources: Learn how protected resources identify the MCP servers, APIs, and other services an agent can access.
• Protected resources policy: Create protected resources, define scopes, and configure client assignments.
• Authorization consents: Learn how customers authorize and revoke access granted to agents and other applications.
• Dynamic clients: Configure support for external agents that provide client metadata through CIMD.