Docs / Agents: CLI, MCP, skill

What a token can reach

A token is what a terminal, a CI job or an agent presents. It is a machine credential minted by a person who is already signed in, and it is narrow by construction. This page is what it can and cannot do, so that handing one to an agent is a decision you can make with open eyes.

One tenant, one environment

A token names one tenant and one environment when it is minted. There is no default: the mint dialog asks. Who may mint one, and what each role may reach, is on People and access. Outside that environment everything answers not found — not forbidden, because a grant is visibility, and a token must not be able to learn what else exists. Two environments are two tokens.

It expires

Every token expires, within 14 days by default (the installation can shorten the ceiling; nothing can lengthen it). Replace mints a successor and never re-issues a value. A token past its expiry is told so by name; an unknown token is refused flat.

It cannot become more than its owner

A token carries none of its owner’s administration: user and tenant management, queue operations, transfers, cross-tenant views are session-only — a browser, a person. A token cannot mint a successor with more rights than itself, and the check sits where a token is minted, so no path around it can compile.

It cannot touch credentials unless told so

By default a token cannot create or repoint a connection, a mail account or any other entity that carries a credential — the threat is not reading a secret (no surface returns one) but wielding one: a repointed connection makes the platform attach the tenant’s bearer to a host the attacker controls. The mint dialog has a facet for that permission, off by default. A script references a connection by name and never needs it.

It works only in the sandbox for three things

Debug runs, stepped runs and probes exist only in a sandbox; production refuses them before anything runs. A probe that would WRITE needs the environment’s write-probe switch (a tenant admin’s, session-only) and an explicit acknowledgement on the call, and is audited.

What it can do

Everything an author does: list, describe, probe a read, write a folder, lint, apply, run, read history and traces, step through a run — in the environment it names, with the credentials it may not touch attached by the platform. That is enough to build an integration alone, and it is what the case study shows.