Ory gives coding agents identities of their own

Ory has detailed Agent Security, a control plane designed to record who delegated work to an AI coding agent and which agent issued each tool call. When an agent runs rm -rf in the wrong working tree or truncates a production table after misreading a prompt, conventional audit logs often identify only a service account or developer OAuth token. Ory describes the missing model, harness, and sub-agent lineage as an accountability gap.

As teams grant coding agents access to shells, repositories, MCP servers, and production APIs, shared credentials obscure the execution path. A command may originate in a user prompt, a model decision, a delegated sub-agent, retrieved content, or a tool response. Collapsing those actors into one account leaves incident responders without a reliable chain of custody.

Static pipelines left simpler trails

CI service accounts fit relatively static workflows because pipeline definitions selected commands in advance and humans approved the code or configuration. The runner account, commit, and job definition usually provided useful provenance. An LLM-based agent chooses commands at runtime from prompts, context, and tool output, so its credential identifies a permission boundary without explaining the resulting behavior.

One session, several authenticated actors

Ory models an agent session as a delegation chain that links the person requesting work to each process performing it. Human authorization and agent authentication use distinct OAuth paths.

Principal	Authentication	Audit question
Human	Interactive OAuth 2.0 sign-in with PKCE	May this person use the requested capability?
Agent	OAuth 2.0 client registered to the project, with a bearer token on each Ory call	Which registered workload issued the call?
Sub-agent	Its own credentials plus a recorded delegation from the parent agent	Which upstream user or agent authorized the action?

Sub-agents authenticate before using tools, and Ory records the upstream delegation first. The resulting trace can connect a user session to an agent, its descendants, and their individual actions even after the original access tokens expire.

Policy checks land before execution

Ory’s control plane integrates inside agent harnesses such as Claude Code, Codex, Gemini CLI, and OpenCode. It intercepts tool calls before execution and applies authorization policies to shell commands, file writes, MCP tools, server connections, and downstream API requests.

Authorization decisions run through Ory Keto, a relationship-based permissions engine modeled on Google’s Zanzibar architecture. In practical terms, Keto evaluates who may perform a specific action on a specific resource. The same policy layer can govern human access and determine whether an agent may invoke Bash, use Edit, or call a named MCP tool.

Two defaults shape deployment

Condition	Ory behavior	Operational effect
Ory is unreachable, rate-limited, or unconfigured	The system fails open, allows the tool call, and logs the error.	Execution continues without a successful policy decision. Environments requiring deny-by-default behavior need a separate blocking control.
A policy allows, denies, escalates, or approves an action	The event is recorded and can be exported through OpenTelemetry.	The delegation chain remains available after bearer tokens expire, subject to the deployment’s log-retention policy.

Audit events form a chain of custody

Correlated session records let responders identify the delegating user, model, harness, agent, spawned sub-agent, requested tool call, and policy result. An investigation can then show which session initiated an action and which rule allowed or blocked it.

Agent sessions may run for hours and generate dozens of causally related tool calls. Individual events provide fragments of that activity. A session-level trace preserves the links among prompts, delegations, policy decisions, and tool use across the full run.

Intent requires separate evidence

An audit entry showing that agent claude-code-7f2a, delegated by engineer Alice, was allowed to issue DROP TABLE establishes identity, delegation, and policy state. Determining whether Alice intended the command, the model generated it independently, or external content influenced the decision requires additional evidence.

A prompt injection can hide malicious instructions in a web page, document, issue, or tool response that the agent reads. Standard logs may record the retrieval as an ordinary data-access event. Investigators may also need the relevant prompts, retrieved content, model and tool outputs, application telemetry, and database logs to reconstruct intent and impact.

Agent identity joins the production stack

Deploying the design requires teams to register agent and sub-agent clients, map tool capabilities to authorization policies, route OpenTelemetry events into existing retention and incident-response systems, and choose an outage policy for each environment. Those decisions determine whether the additional identity data becomes usable evidence during an incident.

Ory says early adopters can use Agent Security coverage on Ory Network free. Production evaluations should test policy latency, identity granularity, failure behavior, log retention, and trace correlation under realistic multi-agent workloads.