Skip to main content
Forge Agent Identity gives an autonomous workload a durable organization-owned identity without treating registration as provider authority. Open Identities → Agents to create identities, enroll runtimes, and manage their access.

​
Registration and enrollment

An Agent identity records its accountable owner, optional owning group, purpose, tags, lifecycle, and optional inventory relationship. Creating it does not create a provider principal, credential, grant, or enrollment. Each runtime enrolls independently:
  1. Create an enrollment for the Agent identity.
  2. Copy the one-time setup token when Forge displays it.
  3. The runtime generates an EC P-256 key pair and exchanges the token with its public key.
  4. Forge consumes the short-lived token atomically and stores no private key or recoverable setup token.
A consumed, expired, revoked, or mismatched setup token cannot be replayed. Revoke one enrollment to remove one runtime. Disabling the Agent identity revokes all pending and active enrollments. Re-enabling it restores only the registration; create new enrollments for runtimes that should return.

​
Agent access

Select Manage agent access to configure each connected provider. Provider setup is separate from the inventory connection because discovery and mutation are different authorities. AWS, Azure, Google Cloud, and GitHub profiles are isolated from one another. Forge activates an access limit only after exact provider or broker readback matches its desired configuration. A stale or mismatched readback blocks new issuance without changing the saved profile.

​
Keyless provider access

Where supported, Forge uses workload federation instead of storing a long-lived provider key. Guided setup creates a dedicated operator or broker trust for the exact issuer, audience, subject, provider scope, and allowed permissions. Use the generated validation artifact to read the trust and permission boundary back from the provider. Access profiles do not silently expand when their limit changes. Create a new immutable revision, review the affected assignments, explicitly apply it, and confirm provider readback.

​
Review and containment

The Agent drawer separates enrollment state, provider assignments, activity, and lifecycle actions. Disabling an Agent identity prevents new Forge authentication and issuance, but already issued provider credentials can remain valid until provider expiry or revocation. Use the provider access and activity sections to confirm containment.