We build agents that act under their own identity, with only the permissions the task needs.
An agent that can read the CRM, draft refunds and call internal APIs is, from a security point of view, a new employee with no manager and a shared password. We design its identity, its tool permissions and its approval steps before we write the prompt.
Employee or customerchat · Slack · web appIdentity providerOkta · Entra ID · Auth0
02 · Agent
Agent with own identityClaude · OpenAI APIPermission-aware retrievalvector index · ACL filterHuman approvalrisky actions only
03 · Tools
MCP serversOAuth-protected · scoped tools
04 · Systems
CRMSalesforceData platformDatabricks · SnowflakeTicketing and docsServiceNow · Jira · SharePoint
Anthropic ClaudeOpenAI APIOktaMicrosoft Entra ID
in short·20-second read
Generative AI and agents means two kinds of system.
One answers questions over your documents with retrieval-augmented generation (RAG). The other takes actions through tools. We build both on Anthropic Claude, the OpenAI API and open models, connect tools over the Model Context Protocol, and give every agent its own identity, scoped OAuth tokens and a human approval step for risky actions. Each release is tested against an evaluation set.
you probably need this if
There's an agent prototype on someone's laptop calling internal systems with an admin API key.
A RAG chatbot answers from documents the person asking is not allowed to read.
Each model change ships without anyone measuring whether answers got better or worse.
terms on this pageDelegationdefinitionLetting an agent act for a specific person, and recording that so your logs show the agent and the person it acted for.explained in a field note →RAGdefinitionRetrieval-augmented generation, or RAG. A search first pulls relevant passages from your documents, and a language model writes the answer from those passages.explained in a field note →
From the first call to a setup your own team can run.
Here's what usually prompts a call about your Generative AI & Agents, what we do about it and in which order, and where you end up.
01 · where it hurts02 · what we change03 · how it runs04 · where you end up
incident board · generative ai & agents3 open
openThere's an agent prototype on someone's laptop calling internal systems with an admin API key.
recurringA RAG chatbot answers from documents the person asking is not allowed to read.
blockedEach model change ships without anyone measuring whether answers got better or worse.
exposure
Permission-aware RAGAgents and tool useMCP servers and clientsAgent identity and delegationEvaluation and red teamingCost and latency control
startrehearsehandover
Pick the task
Prototype against the test set
Harden
Launch and monitor
we are here
ready to hand over
We made answers draw only on documents the asking user could already open.
Now each audit log entry names the person and the agent.
Evaluation dataset and automated scoring
Architecture and data-flow diagram
chapter 01 · where it hurts
Why teams reach out
There's an agent prototype on someone's laptop calling internal systems with an admin API key.
A RAG chatbot answers from documents the person asking is not allowed to read.
Each model change ships without anyone measuring whether answers got better or worse.
chapter 02 · what we change
How we solve it
Permission-aware RAG
Agents and tool use
MCP servers and clients
Agent identity and delegation
Evaluation and red teaming
Cost and latency control
chapter 03 · how it runs
Our approach
Pick the task
Prototype against the test set
Harden
Launch and monitor
chapter 04 · where you end up
What changes
We made answers draw only on documents the asking user could already open.
Now each audit log entry names the person and the agent.
Evaluation dataset and automated scoring
Architecture and data-flow diagram
what we do
Where we spend the hours
6 areas of work, each one done by an engineer who has run it in production.
We carry document permissions into the search index and check them at query time, so the assistant only retrieves what the person asking is allowed to read. Then we tune chunking, hybrid search and citations against your own questions.
Keep the tool list short and explicit. Separate reading from writing, and make payments, deletions and external email wait for a human. Excessive Agency is a named risk in the OWASP Top 10 for LLM Applications 2025.
We build MCP servers to the current 2026-07-28 spec as OAuth 2.1 resource servers. Each publishes Protected Resource Metadata (RFC 9728), takes only tokens issued for its own audience, and never forwards a client's token downstream.
We registered each agent as its own client in Okta, Entra ID or Auth0. When it acts for a user it uses short-lived delegated tokens, requesting scopes step by step, and the logs show which agent did what, for whom, with which grant.
Evaluation sets built from real questions, scored on every change. Prompt injection tests through documents, emails and tool output, because indirect injection is how agents actually get misused.
Smaller models for the simple steps, prompt caching and a token budget per request. And loop limits, so a runaway agent stops before it shows up on the invoice.
capability 01 / 06in production
Permission-aware RAG
We carry document permissions into the search index and check them at query time, so the assistant only retrieves what the person asking is allowed to read. Then we tune chunking, hybrid search and citations against your own questions.
Keep the tool list short and explicit. Separate reading from writing, and make payments, deletions and external email wait for a human. Excessive Agency is a named risk in the OWASP Top 10 for LLM Applications 2025.
We build MCP servers to the current 2026-07-28 spec as OAuth 2.1 resource servers. Each publishes Protected Resource Metadata (RFC 9728), takes only tokens issued for its own audience, and never forwards a client's token downstream.
We registered each agent as its own client in Okta, Entra ID or Auth0. When it acts for a user it uses short-lived delegated tokens, requesting scopes step by step, and the logs show which agent did what, for whom, with which grant.
Evaluation sets built from real questions, scored on every change. Prompt injection tests through documents, emails and tool output, because indirect injection is how agents actually get misused.
Smaller models for the simple steps, prompt caching and a token budget per request. And loop limits, so a runaway agent stops before it shows up on the invoice.
We pieced these together from Generative AI & Agents situations that come up a lot. They're patterns. You won't find a specific client in them.
case file 01
A RAG assistant that quotes documents the asker can't open
composite · not a client story
Beforethe situation
One service account that can read everything feeds SharePoint and Confluence into the assistant's vector store. In testing, a junior analyst asked about bonuses and got an answer that quoted an HR planning file.
What we dothe work
We store each chunk with its source document's access list and filter retrieval by the user's Entra ID group memberships at query time. The all-access service account is replaced with scoped read permissions. Permission test cases join the evaluation set and must pass on every release.
Afterwhere you end up
We made answers draw only on documents the asking user could already open. A permission regression now fails the release instead of reaching staff.
case file 02
An MCP server for the CRM running on one admin integration user
composite · not a client story
Beforethe situation
Someone built an MCP server so an agent could read and update CRM cases. It signs in as a single integration user with admin rights, so every agent action in the audit log carries that one name.
What we dothe work
We put OAuth 2.1 with resource indicators in front of the MCP server, so tokens were issued for that server and checked for audience. The agent acts for the signed-in user with short-lived, scoped tokens. Tools that close or refund cases need human approval, and we log each tool call with user and agent IDs.
Afterwhere you end up
Now each audit log entry names the person and the agent. We can revoke the agent without touching the integration, and the agent can't do more than the person it acts for.
How an agent reaches your systems with its own identity
When a user asks the agent for help, it acts under its own identity with a token that user delegated. The MCP servers it calls all require OAuth and each reaches a business system with narrow scopes. Risky actions wait for a person to approve them.
01 · User
Employee or customerchat · Slack · web app → Agent with own identity · request
Identity providerOkta · Entra ID · Auth0 → Agent with own identity · OAuth token exchange
02 · Agent
Agent with own identityClaude · OpenAI API → Permission-aware retrieval · retrieve as user→ MCP servers · scoped token→ Human approval · write action
Permission-aware retrievalvector index · ACL filter
Human approvalrisky actions only
03 · Tools
MCP serversOAuth-protected · scoped tools → CRM · tool call→ Data platform · query→ Ticketing and docs · tool call
04 · Systems
CRMSalesforce
Data platformDatabricks · Snowflake
Ticketing and docsServiceNow · Jira · SharePoint
Read the diagram as text
Employee or customer → Agent with own identity: request
Identity provider → Agent with own identity: OAuth token exchange
Agent with own identity → Permission-aware retrieval: retrieve as user
Agent with own identity → MCP servers: scoped token
MCP servers → CRM: tool call
MCP servers → Data platform: query
MCP servers → Ticketing and docs: tool call
Agent with own identity → Human approval: write action
how it runs
A typical engagement
We don't start a step until the last one has produced something you can check.
step 01
Pick the task
One workflow, a definition of a correct result and a test set of real examples.
step 02
Prototype against the test set
Model, retrieval and tool choices compared on accuracy, cost and latency.
step 03
Harden
Identity and scopes go in first, then approval steps, injection testing and logging. Only after that is production data connected.
step 04
Launch and monitor
Gradual rollout, with quality, cost and permission use reviewed on a schedule.
you keep
What you're left with
We write these for your Generative AI & Agents setup, and they're working documents. Your team should be able to keep things running from them long after we've gone.
document01
Evaluation dataset and automated scoring
yours to keep
design02
Architecture and data-flow diagram
yours to keep
document03
Agent permission matrix covering tools, scopes and approval rules
Some clients want a project team, some want a couple of engineers on theirs. Either works. Onsite, nearshore or offshore, with handovers across time zones that keep things moving.
Put these to anyone bidding on your Generative AI & Agents work. The ones who've done it answer differently from the ones who've read about it.
Q1
How will retrieval honor the document permissions we already have?
Indexing through one broad service account flattens permissions. Ask how source ACLs are stored, how they're enforced at query time and how that is tested.
Q2
What is the agent's identity, and how are its tokens scoped, bound and revoked?
Agents on shared keys or a user's full session can't be contained. The MCP authorization spec expects audience-bound tokens, so ask how that's implemented.
Q3
Which actions need human approval, and how is that enforced outside the prompt?
Prompt instructions can be overridden by injected text. Approval gates belong in the tool layer, where the model can't talk its way past them.
Q4
How many cases are in the evaluation set, and where did they come from?
A few dozen hand-picked questions won't catch regressions. Cases should come from real requests, including hard and adversarial ones, and run on every change.
Q5
What happens to cost and latency at ten times today's volume?
Prototypes rarely show production economics. Ask for cost and latency per request at expected load, and the plan if either is too high.
01Should we use RAG or fine-tune a model?
RAG, if the answers depend on documents that change. Fine-tuning is for format, tone or a narrow high-volume task, and it won't keep knowledge current. A lot of production systems use retrieval plus a lightly tuned model, or just a well-prompted one.
02Is MCP safe to use in an enterprise?
Treat each MCP server like any other API and it can be. For HTTP servers that use authorization the spec requires OAuth 2.1, resource indicators on token requests and an audience check on every token. Trouble comes from servers that skip those or carry broad credentials of their own.
03How do we stop an agent from doing something it shouldn't?
Give it fewer tools, narrower scopes and its own identity, so you can revoke its permissions without breaking anything else. Put approval gates on irreversible actions and log every tool call. Prompts help a little. Permissions are what actually stop it.
04Which model should we use?
Whichever passes your evaluation set at a cost and latency you can live with. We run Claude, OpenAI and open models against your own examples, and keep the application model-agnostic so switching later is easy.
05Who governs MCP now?
Since December 2025 MCP has sat with the Agentic AI Foundation, a directed fund under the Linux Foundation, after Anthropic donated it. Versions are dated, and 2026-07-28 is the one in force.
related
Often paired with
Projects on Generative AI & Agents usually end up touching one of these, so they're worth a look.
