Agent identity and stewardship

An agent has its own named identity, which an authorized human can revoke. It does not share a person's login and does not consume a team seat.

Personal and team agents

A personal agent is tied to one human steward. The steward is the person accountable for how the agent is used. A team agent is accountable to the team instead. It appears in the agent roster—the list of connected agents—with a TEAM badge. The badge means the team, not one person, is accountable for it.

Both are shipped agent types. Team agents are different from the separate, unshipped team-policy ceilings described in Team agent policy.

Stewardship can change

Authorized managers can use the team's current agent administration to convert a personal agent to a team agent. Where the product permits, they can also assign it to a different responsible person. Both actions keep the agent identity and earlier attribution.

If the original steward leaves the team, an authorized manager should review the agent and either assign it to someone else, convert it to a team agent, or revoke it if it should no longer operate. Do not assume that the departing person's old authority continues to support the agent.

Stewardship is not access

Stewardship answers who is accountable. It does not grant access or actions.

An agent also needs:

• a workspace grant, which gives access to one named workspace; and
• the required read, write, share, or publish capability, which allows that type of action.

A workspace grant decides where the agent can act. Capabilities decide what it can do there. Neither can exceed the steward's live permission. Changing the responsible person or team does not automatically add workspaces or capabilities, so review both separately afterwards.

See Workspace access and What your agent can and cannot do.

Identity, naming, and attribution

The agent's recognizable name appears on its changes and in agent administration. Reconnecting with the same agent identity preserves attribution to earlier work; creating another identity produces a separate agent.

Only an authorized human can approve an identity, stewardship, workspace grants, and capabilities. An agent cannot grant itself access, widen its own grants, or invite another agent.

Live enforcement

Authorization is checked on every request against the current stewardship, workspace grants, capabilities, and live permissions. Changes therefore apply on the next request.

Use current agent administration to inspect the roster, identify personal and TEAM agents, change stewardship where authorized, and revoke an agent. Use workspace access controls—not artifact Share—to review where it can operate.

Related pages

• Team management
• Workspace access
• Revoke an agent
• Staying connected

Questions and answers

Does a TEAM badge give the agent access to every workspace? No. It identifies team accountability only; workspace grants and capabilities are separate.

What should I review after changing stewardship? Review the agent's workspace grants and capabilities separately because conversion or reassignment does not change them automatically.

What happens if a personal agent's steward leaves? An authorized manager should reassign it, convert it to a team agent, or revoke it. Do not rely on the departed person's authority.

Direct answer

An agent is a named identity that an authorized human can revoke. It has a stewardship state, workspace grants, and capabilities. A workspace grant allows access to one workspace. A capability allows an action such as read or write. The agent does not share a human login or consume a team seat.

Stewardship states

Both states are live. Do not describe team agents as planned policy. Team agent policy covers separate policy ceilings that have not shipped.

Stewardship transitions

Authorized managers may convert a personal agent to a team agent or re-home it where the product permits. Re-home means assign accountability to another steward. If the original steward leaves, route the agent to current agent administration for an authorized manager to re-home, convert, or revoke it. The departed steward's authority does not remain active.

A stewardship transition preserves the agent identity and existing attribution. It does not implicitly broaden access.

Authorization layers

A request is allowed only when all applicable layers permit it:

1. the agent identity is active;
2. the agent has a grant to the target workspace;
3. the agent has the required read, write, share, or publish capability; and
4. the steward's live authority permits the operation.

Stewardship defines accountability. Workspace grants define where the agent may act. Capabilities define what it may do. Conversion or re-homing changes only stewardship unless an authorized human separately changes grants or capabilities.

Never infer workspace access from team membership, an artifact URL, stewardship, or previous access to another workspace. See Workspace access.

Human-only administration

Unless a verified tool explicitly supports the operation, instruct an authorized human to use current team agent administration to inspect identity and stewardship, perform permitted conversion or re-homing, or revoke the agent. Workspace grants are reviewed in workspace access controls. Artifact Share is not an administration route.

An agent cannot approve itself, widen its own grants or capabilities, or invite another agent. On denial, stop and request review by the steward or an authorized manager without probing for hidden workspaces.

Enforcement and attribution

Authorization is evaluated on every request, so changes apply on the next request. The agent's name remains attached to its changes, including after a stewardship transition. Reconnection with the same identity preserves earlier attribution.

Related pages

• Team management
• Workspace access
• What your agent can and cannot do
• Revoke an agent

Questions and answers

Which state determines accountability? Personal or team stewardship. A TEAM badge identifies team accountability; it does not grant workspace access.

What must be checked before an operation? Active identity, target-workspace grant, required capability, and the steward's live authority.

How is a stewardship change verified? Inspect current agent administration, then separately verify workspace grants and capabilities because re-homing or conversion does not change them automatically.