AI agent access control in SSOGEN
SSOGEN controls which applications an AI agent may reach, for whom, and how you stop it. An AI agent is software that calls your applications on its own or for a person: a coding assistant, a support bot, a nightly automation. SSOGEN gives each agent a real identity with an owner, an expiry and an explicit list of what it may reach, and records everything it does.
Without a control point, such software tends to run on a shared password or a long-lived key nobody owns. For tool servers that speak the Model Context Protocol, the MCP gateway in the SSOGEN Gateway checks each tool call against the scopes the agent was granted.
This page explains the ideas. The step-by-step guides are listed at the end.
The pieces of an agent’s identity and access
Section titled “The pieces of an agent’s identity and access”Identity. Every agent is registered in the Admin Console under AI agents, then Identities. It has a name, a permanent identifier, a type, up to five owners (people, never groups) and one primary owner. It is first saved as Pending, and it can do nothing until an administrator activates it.
Owners. Each agent has someone who answers for it. If the last owner leaves, the agent is suspended automatically (“Suspended: its owner left. Add an owner before reactivating.”). An agent also has an Expires on date, a Review by date, or both, no more than 365 days ahead. An agent nobody reviews by its review date is suspended.
No passwords for agents. An agent proves who it is with a key pair: you register the public key and the agent keeps the private key. SSOGEN refuses a registration that contains a private key. Every token SSOGEN issues to an agent is tied to that agent’s key, so a copied token is useless to anyone else, and a token lives only about four minutes.
Access you grant. You choose which applications the agent may reach and which scopes it may use there. A scope is a named permission that you define on the application, for example “Read invoices”. A request that maps to no granted scope is refused.
Two ways of acting.
| Mode (as the console says it) | Meaning |
|---|---|
| Acts on its own | The agent has its own authority. It needs a passing Test access before it can be activated. |
| Acts for a person | The agent works on a person’s behalf, and only after that person has agreed. Its effective access is the part of its grants that the person allowed and still has. |
Delegation: an agent acting for a person
Section titled “Delegation: an agent acting for a person”When an agent that Acts for a person needs to work for Maria Lopez, SSOGEN sends Maria to sign in under the application’s normal sign-in policy. She then sees a consent screen titled “Invoice Assistant wants to act for you”. It shows who owns the agent, what the owner says it does, the applications and scopes it asks for, and how long the permission lasts. Maria can shorten the duration, then select Approve or Deny.
An approval is called a delegation. It is limited to the scopes and applications shown. It expires: never later than 30 days after approval and never later than the agent’s own expiry. Maria can withdraw it at any time in My Account, and an administrator can revoke it too. A delegation never gives an agent anything Maria does not already have.
Scopes you mark Sensitive are never part of a delegation. They need a fresh approval every time, as described next.
Approvals for sensitive scopes
Section titled “Approvals for sensitive scopes”Some actions deserve a human decision at the moment they happen, such as approving a payment. Mark that scope Sensitive. When the agent wants to use it for Maria, SSOGEN holds the request until Maria approves or denies it on her Approvals page, after a recent strong sign-in. The page shows the agent, its owner, what it wants to do, and an optional short message from the agent under the label “The agent says”.
Approving gives the agent a short window to use that scope. It is not approval of one particular operation, and SSOGEN does not see what the agent does with it. The page tells the person this in so many words.
Kill switches and other ways to stop an agent
Section titled “Kill switches and other ways to stop an agent”| Control | Effect |
|---|---|
| Suspend (one agent) | No new tokens. Reversible with Reactivate. |
| Revoke permanently | The agent can never be used again. Its keys, delegations and refresh tokens stop working. The record stays for history. |
| Kill switch (one type) | Suspends every active agent of one type at once, and blocks activating others of that type until you release it. |
| Revoke delegation (administrator) or Withdraw (the person) | Stops one agent acting for one person. |
| Turn the organization setting off | SSOGEN stops issuing tokens to any agent. Nothing is deleted. |
New tokens stop at once. A token already issued stops working within 5 minutes at most. To stop everything immediately, engage a kill switch before you turn the organization setting off.
Audit trail of agent activity
Section titled “Audit trail of agent activity”Everything an agent does is recorded: registration, activation, suspension, key and access changes, kill-switch changes, every token issued or refused, every delegation granted or revoked, every approval requested and decided and, for agents calling through the Gateway, each decision about a call. Entries never contain tokens, keys or the agent’s message to the person. Find them in Monitoring, then Audit, or on one agent’s own Activity tab.
Where AI agents reach your applications
Section titled “Where AI agents reach your applications”- A normal HTTP application published through the App Proxy. The App Proxy checks the agent’s token and its key proof, then tells your application which agent is calling.
- A tool server that speaks the Model Context Protocol (MCP), through the MCP Gateway. The MCP Gateway authorizes each tool call against the scopes granted. See Connect an AI agent to Oracle E-Business Suite with the MCP Gateway.