PingOne Privilege

Agent registry

Agent registry is where each agent becomes a first-class identity with an owner, an authentication method, and a lifecycle. Registration is what every other control hangs on. Unregistered or revoked agents are denied, and registered ones get policy, attribution, and lifecycle control. At the AI Gateway, the registered agent’s identity is validated on every call with a comprehensive, attributable audit trail.

Registering an agent

Administrators can register an agent on the Agent Registry page. During configuration, you define what the agent acts on behalf of, when its access expires, how it authenticates, and what it may reach. The wizard steps through agent details, access configuration, runtime protection, and review.

Before you begin

Ensure the following:

  • If you’re configuring tools for MCP access, you have configured one or more MCP server applications that the agent will access.

  • If you’re configuring tools for A2A access, you have one or more configured remote agent applications that the agent will access.

Step 1: Configure agent identity and access

  1. In the PingOne Privilege admin console, go to AI Security > Agent Registry.

  2. Click Add Agent.

  3. In the Agent Details section, configure:

    • Agent Name: A name for the agent, shown in audit logs.

    • Custodian: Select the user the agent will act on behalf of. PingOne Privilege attributes the actions the agent performs to this user, and the agent’s key inherits that user’s permissions.

    • Expires: When the agent’s access expires, such as in 30 days. Short-lived keys reduce blast radius; you can revoke keys instantly at any time.

  4. Define how the agent will authenticate with the AI gateway:

    • API Key: PingOne Privilege generates a virtual API key at creation. The real API key is never exposed to the user or agent. You can copy it once the agent is created in AI Security > Agent Registry by clicking More options () on the created agent.

    • Workload Identity: The agent presents its own platform token:

      • Kubernetes service-account tokens.

      • GitHub Actions and GitLab CI/CD job tokens.

      • SPIFFE JWT-SVIDs.

      • Any OIDC issuer with published keys.

  5. For Access Scopes, define what the agent may reach through the AI gateway:

    • Models: LLM providers the agent can call through AI Gateway.

    • Tools: MCP servers the agent can reach through MCP Gateway, with capability-level policy on the tools, prompts, and resources it may use.

    • Agents: Peer agents the agent can communicate with over A2A connections.

  6. Click Continue.

Step 2: Configure AI gateway and apps

In this step, the configuration depends on agent type:

  • LLM: Allows the agent to reach specific LLM providers through the gateway with a virtual API key, enforcing model controls, spend limits, with complete usage accounting.

  • MCP: Allows the agent to reach specific tools for the associated MCP Server.

  • A2A: Allows the agent to communicate with Remote Agent peer applications over agent-to-agent (A2A) connections.

Option 1: Configuring models for LLM access

If you selected LLM as your Access Scope in the previous step, configure the following fields:

  1. Select a Provider for your agent.

  2. Enter the Real Provider Key.

    PingOne Privilege stores this key encrypted, injects it only inside the gateway, and never exposes it to the agent.

  3. Configure model access and limits:

    • Allowed models: Restrict which models the agent may call. If you don’t select any models, the agent can call all the provider’s models.

    • Rate limit - RPM: Cap requests per minute (RPM).

    • Rate limit - TPM: Cap tokens per minute (TPM).

    • Budget Period: Set the period the budgets apply to, such as monthly.

    • Budget - USD: Cap spending in United States dollars (USD). Zero means unlimited.

    • Budget - Tokens: Cap spending in tokens. Zero means unlimited.

  4. Click Continue to proceed to the next step.

The agent now authenticates to the selected providers with the virtual API key issued by PingOne Privilege, and its calls are subject to the model policy and spend limits enforced by the LLM Gateway.

Option 2: Configuring tools for MCP access

If you selected MCP as your Access Scope in the previous step, configure the following fields:

  1. Select one or more MCP Servers to access through this agent.

  2. Click Configure Tools.

  3. In the MCP Server list, select the MCP server you are configuring.

  4. Click Select Tools to select tools or click Match by pattern to search by RegEx.

  5. Click Continue to proceed to the next step.

The agent now reaches the selected MCP servers through the AI Gateway. Credentials and tokens terminate at the AI Gateway, are injected at request time, and are never forwarded downstream. Tool calls are logged in Activity > Activity Logs.

Option 3: Configuring agents for A2A access

If you selected A2A as your Access Scope in the previous step, configure the following fields:

  1. Select the Remote Agents to access through this agent.

  2. Click Continue to proceed to the next step.

Step 3: Configuring AI guard

AI Guard inspects the traffic between AI agents and the services they reach, whether that traffic is LLM, MCP, or A2A.

  1. In the AI Guard section of the setup wizard, configure the following toggles:

    • Enable AI Guard: Toggled on by default for AI guard protection. Toggle off to disable.

    • Fail Closed: Enable to block traffic if the guard errors.

  2. Under Detector Policies, you can review the policies for each detector category by clicking View Details in its tile.

  3. For each detector tile, you can adjust the detection thresholds with the following rules:

    • Alert: Logs a warning.

    • Sanitize: Where available, redacts matching content and forwards.

    • Block: Stops the request.

      The Alert configuration must always be lower than the Block configuration.

  4. You can adjust the following detector categories and parameters:

    • Content & Prompt Safety: Protect the model from manipulation and poisoned context. Click the gear icon to adjust the thresholds for this category:

      • Prompt Injection

      • Jailbreak

      • Hidden Instructions

      • Memory Poisoning

    • Data Protection: Protect the model from manipulation and poisoned context. Click the gear icon to adjust the thresholds for this category:

      • PII

      • Data Exfiltration

    • Tool & Agent Safety: Protect the model from manipulation and poisoned context. Click the gear icon to adjust the thresholds for this category:

      • Tool Abuse

      • Tool Poisoning

      • Schema Violation

      • Inter-Agent Abuse

    • Content Safety: Protect the model from manipulation and poisoned context. Click the gear icon to adjust the thresholds for this category:

      • Malicious Content

    • External Inspection: Send eligible content to an independently managed evaluator. Enable a detector in this category to configure its thresholds:

      • External Guardrail

    • Advanced - ML Sidecar: Configure the external evaluator endpoint and fail-safe behavior. Enable an External Guardrail detector in External Inspection to configure its fields:

      • ML Sidecar URL: Required when External Guardrail detector is enabled.

      • Sidecar Timeout (ms): Per-call timeout. Default is 1000 (ms).

      • Auth Header: Sent with every sidecar, formatted as Name: value. Leave blank for no header.

      • Block Agreement: Controls how the ML sidecar verdict is merged with the deterministic detector layer. The following options are available in the list:

        • off: ML blocks alone so that no deterministic agreement needed.

        • unit: ML block honored only if a deterministic detector fired on the same content unit.

        • inspection: ML block honored if a deterministic detector fired anywhere in the request.

      • Sidecar Fail Closed: Block traffic if the Sidecar errors.

  5. After you’ve reviewed and configured detection policies, click Next.

  6. Review the overview of your configurations from previous steps. If these configurations are correct, click Create Agent.

Step 4: Establish connectivity between agent and gateway

The final Add Agent page contains your Agent Key that you’ll use to configure your agent to connect to an AI gateway.

This key will only be displayed on this page and not available after configuration.

  1. Under Integration, select a configured Gateway from the list to point your agent at that gateway.

  2. Copy the code containing your virtual key.

  3. Use the code you just copied to connect to the Agentic App through your client. For example, you can paste the code into Claude Desktop.

    Result: The associated LLM, MCP, or A2A is now accessible through that client.

  4. After pasting the key and establishing connectivity, click Done - Go To Agents.

    Result: On the Agent Registry page, the agent you registered should now be in the list.

  5. Validate that the registered agent’s tools appear in the client and that restricted tools don’t appear.

Result

Users can now get the MCP Config for connecting their client to the registered agent under Agentic Apps in the PingOne Privilege user console.