> ## Documentation Index
> Fetch the complete documentation index at: https://docs.forge.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Identity model

> Choose the right Forge or provider identity for each human, agent, and service.

Forge keeps identities separate when they represent different security
boundaries. Select the identity type based on where the principal exists and
what it needs to authenticate to.

| Identity type                    | Represents                                                                                                         | Created in                                            | Typical use                                                                          |
| -------------------------------- | ------------------------------------------------------------------------------------------------------------------ | ----------------------------------------------------- | ------------------------------------------------------------------------------------ |
| Directory user or group          | A person or managed team                                                                                           | Your connected directory                              | Console access, attribution, policy scope, ownership, and approvals                  |
| Provider-native NHI              | A machine principal such as a cloud role, service account, managed identity, application, or repository credential | AWS, Azure, Google Cloud, GitHub, or another provider | Discovering machine access, ownership, credentials, activity, and provider posture   |
| Agent identity                   | An autonomous workload owned by your organization                                                                  | Forge                                                 | Runtime enrollment and bounded, keyless provider access                              |
| LLM Gateway service account      | A non-interactive caller of Forge LLM Gateway                                                                      | Forge                                                 | Authenticating an application or service to LLM routes, models, budgets, and policy  |
| Forge API or MCP service account | An automation principal for Forge management interfaces                                                            | Forge                                                 | Calling the Forge API or Forge MCP with explicitly assigned organization permissions |

## Provider-native NHIs

Provider-native NHIs are discovered from connected cloud and repository
systems. Forge preserves the provider's identity, account scope, credentials,
access, activity, and available ownership evidence. Inventory does not create
or silently take control of the provider principal.

Use **Identities → NHIs** when you need to investigate an existing machine
identity, find unowned access, or perform a supported provider-native action.
See [Non-human identities](/observe/non-human-identities).

## Agent identities

An Agent identity is the durable Forge identity for one autonomous workload.
It records ownership and lifecycle independently from any cloud role or
repository credential. Enrolled runtimes authenticate to Forge, and supported
provider access is assigned through bounded access profiles.

Use **Identities → Agents** when the workload needs its own Forge lifecycle,
runtime enrollments, or keyless provider access. See
[Agent identities](/secure/agent-identities).

## Gateway service accounts

An LLM Gateway service account authenticates a server-side application to
Forge's model routes. Its keys belong to the calling workload and should be
scoped, rotated, and stored like any other application credential. The service
account does not become a provider-native NHI or an Agent identity merely
because it generates AI activity.

Use this identity when a service needs LLM Gateway routes, model access,
budgets, and content policy without a signed-in human. See
[LLM Gateway](/secure/llm-gateway).

## Forge API and MCP service accounts

Forge API and Forge MCP service accounts authorize automation that manages or
queries Forge. Assign only the organization permissions required by the
automation. These credentials do not authorize an upstream model, cloud
provider, or Registry MCP server unless that access is configured separately.

See [Roles](/secure/roles), [REST API](/developer/api), and
[Forge MCP](/developer/mcp).

## Relating identities without merging them

One workload can legitimately have several related identities. For example, an
Agent identity can enroll a runtime, use an AWS role discovered as an NHI, and
call LLM Gateway with a service-account key. Keep those principals separate so
their credentials, owners, permissions, and revocation paths remain clear.