---
title: Remote Agent
description: A Remote Agent application registers an agent that connects to PingOne Privilege from outside your network.
component: privilege
page_id: privilege:agent-privilege:configuration/agentic-apps/remote-agent
canonical_url: https://docs.pingidentity.com/privilege/agent-privilege/configuration/agentic-apps/remote-agent.html
llms_txt: https://docs.pingidentity.com/privilege/llms.txt
docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md
revdate: September 10, 2026
section_ids:
  configure-a-remote-agent-integration: Configure a Remote Agent integration
  before-you-begin: Before you begin
  step-1-create-a-remote-agent-application-in-pingone-privilege: "Step 1: Create a Remote Agent application in PingOne Privilege"
  step-2-register-the-remote-agent: "Step 2: Register the remote agent"
  result: Result
  step-3-apply-policy-to-the-remote-agent: "Step 3: Apply policy to the remote agent"
  step-4-establish-connectivity-between-agent-and-gateway: "Step 4: Establish connectivity between agent and gateway"
  result-2: Result
---

# Remote Agent

A remote agent application connects to your environment through an AI gateway, which provides the policy enforcement point and credential injection.

This integration provides:

* AI-powered service that autonomously performs tasks, makes decisions, and interacts with external systems to achieve a goal.

* Tool, prompt, and resource-level PingOne Privilege policy.

* Full audit of agent tool calls in **Activity > Activity Logs**.

## Configure a Remote Agent integration

Configuration involves creating a Remote Agent application in PingOne Privilege, registering the remote agent, configuring policies for the application, and establishing connectivity between the agent and an Agent Privilege gateway.

### Before you begin

Ensure you have an AI gateway configured in Directory > Gateways. Learn more in [AI gateways](../ai-gateways.html).

### Step 1: Create a Remote Agent application in PingOne Privilege

1. In the PingOne Privilege admin console, go to **AI Security > Agentic Apps**.

2. Click the **Add Application** tab and select the **Remote Agent** tile.

3. Configure the following fields:

   * **Application Name**: A name for the application. Must be lowercase with no spaces, for example, `developer-workstation-agent`.

   * **Frontend URL Path (optional)**: A path for the frontend URL.

   * **Backend URL**: The endpoint of the remote agent platform.

   * **Discover A2A agent card**: Check this option to fetch `/.well-known/agent-card.json` from the backend and list the agent skills. Leave unchecked for a plain web application.

   * **Auth Mode**: Available options are:

     * **Static Token**

     * **User Token**: The authorization token will be sourced automatically from the user's vault credential at request time. No token input is required.

     * **Pass Agent Token**: The calling agent's own verified token is forwarded to this agent, which can then verify it independently and scope what it returns to the end user it names.

       |   |                                                                                                           |
       | - | --------------------------------------------------------------------------------------------------------- |
       |   | Calls made with a static API key or an interactive sign-on are refused, because they carry no such token. |

     * **None**: No authentication will be sent to the remote agent. Use this only if it's publicly accessible or secured at the network level.

   * **Headers (optional)**: To add headers, enter key/value pairs, then click **Add Header [icon: plus, set=fa]**.

   * **Mesh Cluster**: Select the mesh cluster for the AI gateway that mediates access to the application.

4. Click **Create**.

### Step 2: Register the remote agent

1. Select the **Remote Agent** application when you configure an agent's access in [Agent Registry](../agent-registry.html). Remote Agent applications are reachable as peer agents through the agent's key.

2. Configure the remote agent to connect to PingOne Privilege using the application's connection details.

3. Run the agent and confirm that it connects.

#### Result

The application is now reachable as a peer agent.

### Step 3: Apply policy to the remote agent

1. In the PingOne Privilege admin console, go to **AI Security > Agentic Apps**.

2. In the list, find the **Remote Agent** application.

3. Click **(⋮)**, then click **Create Policy**.

4. Select which operations from the Remote Agent specification are available to agents.

5. Click **Update Configuration**.

6. Add the users or groups the policy will apply to.

7. Define the users or groups the policy will apply to.

8. Click **Continue**.

9. Configure the policy with the following fields:

   * **Policy Name**

   * **Select Timezone**

   * **Start Date** and **Start Time**

   * **End Date** in hours, days, weeks, months, or custom date.

10. Click **Submit** to save the policy.

### Step 4: Establish connectivity between agent and gateway

1. In the PingOne Privilege admin console, go to **AI Security > Agentic Apps**.

2. On the **Active Applications** tab, find the **Remote Agent** application and click **More Info**.

3. On the **Overview** tab's **Resource Information** section, select a configured **AI Gateway** from the list.

4. Copy the **Agent URL**.

5. Use the URL you just copied to connect to the **Remote Agent** app through your client, for example, through Claude Desktop.

   **Result:** The associated **Remote Agent** app is now accessible through that client.

6. Validate that the Remote Agent tools appear in the client and that restricted tools don't appear.

### Result

Users can now get the **Agent URL** for connecting their client to the **Remote Agent** app under **Agentic Apps** in the PingOne Privilege user console.