# Outbound binding elements

> Field reference for the Credential Delegation and Workload Binding canvas elements: attaching cached OAuth or API key tokens to outbound calls, and binding managed-agent identity and caller context into outbound Verifiable Presentations.

Two canvas elements bind outbound context to upstream requests. Credential Delegation injects cached OAuth or API key tokens from a credential provider into calls on the caller’s behalf. Workload Binding binds the managed-agent identity and selected caller-context claims into the outbound Verifiable Presentation injected by a Transit Point.

## Credential Delegation

The Credential Delegation element binds external credential providers (OAuth, API key) to a surface so the gateway attaches cached tokens to outbound calls on the caller’s behalf. When no token is held for a given caller, the gateway signals consent_required back rather than forwarding the request.

Drop it on the Managed Agent → External request edge. One element per surface (singleton).
Note

Credential delegation requires both a Caller Context element and at least one Identity element to be configured on the surface. The gateway binds tokens to an authenticated caller identity and a managed-agent workload. Both are required.

### Fields

Each row in the outbound credential binding list configures one credential provider.

| Field | Type | Required | Default | Description |
| Credential Provider | select | Yes | — | The credential provider supplying the token. Select from providers managed at Security → Credential Providers. |
| Scopes | string | No | — | Space- or comma-separated OAuth scopes to request when acquiring a token for the caller. |
| Consent mode | select | No | On demand | How the gateway handles a missing token. Options: On demand (signals consent_required back to the caller), Pre-authorize (blocks the request until consent is granted), Elicit (sends an MCP elicitation prompt to the caller). |
| Elicit timeout | integer | Yes (when Consent mode = Elicit) | 300 | Seconds to wait for the caller to complete the elicitation prompt before applying the fallback. |
| Elicit fallback | select | Yes (when Consent mode = Elicit) | On demand | What the gateway does when the caller does not support elicitation. Options: On demand (signals consent_required), Fail (returns not_applicable). |
| Required for | select | No | All outbound requests | Which requests trigger credential injection. Options: All outbound requests, Specific MCP tools only. |
| Required for tools | string | Yes (when Required for = Specific MCP tools only) | — | Comma-separated MCP tool names. The gateway only injects the credential when one of these tools is called. |
| Inject as | select | No | Bearer header | How the token is attached to the outbound request. Options: Bearer header (Authorization: Bearer <token>), Custom header (a named HTTP header), JSON-RPC _meta (a field in the JSON-RPC _meta object). |
| Header name | string | Yes (when Inject as = Custom header) | — | The HTTP header name to write the token into. |
| Header format | string | No (when Inject as = Custom header) | token {value} | Template for the header value. {value} is replaced with the token at injection time. |
| Meta field name | string | Yes (when Inject as = JSON-RPC _meta) | — | The _meta field name to write the token into. |

## Workload Binding

The Workload Binding element binds the managed-agent identity and a chosen set of caller-context claims into the outbound Verifiable Presentation (agent-identity-credential/v1) injected by a Transit Point. A downstream Trust Gateway can then verify which workload is acting and on whose behalf it is acting.

Drop it on the Managed Agent → Transit Point request edge. Each Transit Point can carry its own Workload Binding.

### Fields

| Field | Type | Required | Default | Description |
| Enable workload binding | bool | No | On | Activates the binding for this Transit Point or target leg. When off, no VP is injected. |
| Caller context source | select | No | Transit token | Where caller claims are read from. Options: Transit token (claims from the signed transit token presented to this Transit Point), Authorization bearer JWT (claims from the inbound Authorization: Bearer JWT). On the MA → External leg, this field is fixed to Authorization bearer JWT. |
| Caller field allowlist | string[] | No | [] | Top-level caller claim names copied into the binding VP. Only listed names cross the boundary. Leave empty to bind no caller claims. Nested paths (a.b) are not supported. |
| Chain caller-supplied credentials | bool | No | Off | When on, a caller-presented VC or VP is chained into the binding VP so the downstream gateway sees the full delegation chain. |

## Related

- [Caller Context element](/products/affinidi-trust-fabric/agent-gateway/reference/surfaces/caller-context.md): required dependency for Credential Delegation.

- [Identity element](/products/affinidi-trust-fabric/agent-gateway/reference/surfaces/identity.md): required dependency for Credential Delegation; the Managed Agent → Transit Point placement populates the managed-agent identity used by Workload Binding.

- [Transit Points reference](/products/affinidi-trust-fabric/agent-gateway/reference/surfaces/transit-points.md): the Transit Point that receives the bound VP.