PingOne Privilege

Remote Agent

A remote agent application connects to your environment through an AI gateway, which provides the policy enforcement point and credential injection.

This integration provides:

  • AI-powered service that autonomously performs tasks, makes decisions, and interacts with external systems to achieve a goal.

  • Tool, prompt, and resource-level PingOne Privilege policy.

  • Full audit of agent tool calls in Activity > Activity Logs.

Configure a Remote Agent integration

Configuration involves creating a Remote Agent application in PingOne Privilege, registering the remote agent, configuring policies for the application, and establishing connectivity between the agent and an Agent Privilege gateway.

Before you begin

Ensure you have an AI gateway configured in Directory > Gateways. Learn more in AI gateways.

Step 1: Create a Remote Agent application in PingOne Privilege

  1. In the PingOne Privilege admin console, go to AI Security > Agentic Apps.

  2. Click the Add Application tab and select the Remote Agent tile.

  3. Configure the following fields:

    • Application Name: A name for the application. Must be lowercase with no spaces, for example, developer-workstation-agent.

    • Frontend URL Path (optional): A path for the frontend URL.

    • Backend URL: The endpoint of the remote agent platform.

    • Discover A2A agent card: Check this option to fetch /.well-known/agent-card.json from the backend and list the agent skills. Leave unchecked for a plain web application.

    • Auth Mode: Available options are:

      • Static Token

      • User Token: The authorization token will be sourced automatically from the user’s vault credential at request time. No token input is required.

      • Pass Agent Token: The calling agent’s own verified token is forwarded to this agent, which can then verify it independently and scope what it returns to the end user it names.

        Calls made with a static API key or an interactive sign-on are refused, because they carry no such token.

      • None: No authentication will be sent to the remote agent. Use this only if it’s publicly accessible or secured at the network level.

    • Headers (optional): To add headers, enter key/value pairs, then click Add Header .

    • Mesh Cluster: Select the mesh cluster for the AI gateway that mediates access to the application.

  4. Click Create.

Step 2: Register the remote agent

  1. Select the Remote Agent application when you configure an agent’s access in Agent Registry. Remote Agent applications are reachable as peer agents through the agent’s key.

  2. Configure the remote agent to connect to PingOne Privilege using the application’s connection details.

  3. Run the agent and confirm that it connects.

Result

The application is now reachable as a peer agent.

Step 3: Apply policy to the remote agent

  1. In the PingOne Privilege admin console, go to AI Security > Agentic Apps.

  2. In the list, find the Remote Agent application.

  3. Click (⋮), then click Create Policy.

  4. Select which operations from the Remote Agent specification are available to agents.

  5. Click Update Configuration.

  6. Add the users or groups the policy will apply to.

  7. Define the users or groups the policy will apply to.

  8. Click Continue.

  9. Configure the policy with the following fields:

    • Policy Name

    • Select Timezone

    • Start Date and Start Time

    • End Date in hours, days, weeks, months, or custom date.

  10. Click Submit to save the policy.

Step 4: Establish connectivity between agent and gateway

  1. In the PingOne Privilege admin console, go to AI Security > Agentic Apps.

  2. On the Active Applications tab, find the Remote Agent application and click More Info.

  3. On the Overview tab’s Resource Information section, select a configured AI Gateway from the list.

  4. Copy the Agent URL.

  5. Use the URL you just copied to connect to the Remote Agent app through your client, for example, through Claude Desktop.

    Result: The associated Remote Agent app is now accessible through that client.

  6. Validate that the Remote Agent tools appear in the client and that restricted tools don’t appear.

Result

Users can now get the Agent URL for connecting their client to the Remote Agent app under Agentic Apps in the PingOne Privilege user console.