Identity
Create your first managed agent
An agent record is not a login. It is the answer to “who is acting, and why” that every later decision and every audit entry hangs from.
- Agents & identity
- 4 min read
What you are being asked for
- Name
- How this agent appears in approvals and activity. Use the job, not the vendor: Content drafting assistant reads better in a review queue than API client 2.
- Purpose
- One sentence in operational language. A reviewer at 4pm on a Friday should be able to judge a request against it without reading code.
- Environment
- Production, staging, or development. This is part of the identity, not a label.
One agent, one purpose
The temptation is a single “automation” identity that everything shares. Resist it. A shared identity produces an audit trail that cannot answer the only question that matters after an incident: which system did this?
Separate identities also let you keep separate permission matrices. A drafting agent and a publishing agent are different risk profiles, and they should not inherit each other’s grants.
There is no per-agent fee and no per-call fee. The only cost of another agent is another credential to manage — which is the thing you wanted anyway.
What the agent can do immediately
Nothing. A new agent is created paused, and every Ability is blocked until you grant one explicitly. It can authenticate once you connect it, and it appears on the dashboard, but every request it makes is refused.
So there are two deliberate steps before it can work: grant the permission, then activate the agent — open it on the Agents screen and choose Activate. Granting without activating is the most common reason a first request is still refused.
Next: choose the WordPress user it connects as, then grant one narrow permission.
Agents & identity
Keep the boundary while you fix the problem.
A good fix restores intended behaviour without creating a second path around WordPress or the governed request lifecycle.