> ## Documentation Index
> Fetch the complete documentation index at: https://docs.forge.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Agent identities

> Register agents, enroll runtimes, and bound their provider access.

Forge Agent Identity gives an autonomous workload a durable organization-owned
identity without treating registration as provider authority. Open
**Identities → Agents** to create identities, enroll runtimes, and manage their
access.

## Registration and enrollment

An Agent identity records its accountable owner, optional owning group,
purpose, tags, lifecycle, and optional inventory relationship. Creating it does
not create a provider principal, credential, grant, or enrollment.

Each runtime enrolls independently:

1. Create an enrollment for the Agent identity.
2. Copy the one-time setup token when Forge displays it.
3. The runtime generates an EC P-256 key pair and exchanges the token with its
   public key.
4. Forge consumes the short-lived token atomically and stores no private key or
   recoverable setup token.

A consumed, expired, revoked, or mismatched setup token cannot be replayed.
Revoke one enrollment to remove one runtime. Disabling the Agent identity
revokes all pending and active enrollments. Re-enabling it restores only the
registration; create new enrollments for runtimes that should return.

## Agent access

Select **Manage agent access** to configure each connected provider. Provider
setup is separate from the inventory connection because discovery and mutation
are different authorities.

| Object           | Purpose                                                      |
| ---------------- | ------------------------------------------------------------ |
| Access limit     | Maximum provider scope and permissions any agent can receive |
| Access profile   | Reusable, provider-specific permission set within that limit |
| Profile revision | Immutable version of an access profile                       |
| Assignment       | Binds an Agent identity to an active profile revision        |

AWS, Azure, Google Cloud, and GitHub profiles are isolated from one another.
Forge activates an access limit only after exact provider or broker readback
matches its desired configuration. A stale or mismatched readback blocks new
issuance without changing the saved profile.

## Keyless provider access

Where supported, Forge uses workload federation instead of storing a long-lived
provider key. Guided setup creates a dedicated operator or broker trust for the
exact issuer, audience, subject, provider scope, and allowed permissions. Use
the generated validation artifact to read the trust and permission boundary
back from the provider.

Access profiles do not silently expand when their limit changes. Create a new
immutable revision, review the affected assignments, explicitly apply it, and
confirm provider readback.

## Review and containment

The Agent drawer separates enrollment state, provider assignments, activity,
and lifecycle actions. Disabling an Agent identity prevents new Forge
authentication and issuance, but already issued provider credentials can
remain valid until provider expiry or revocation. Use the provider access and
activity sections to confirm containment.