Outbound binding elements
Two canvas elements bind outbound context to upstream requests. Credential Delegation injects cached OAuth or API key tokens from a credential provider into calls on the caller’s behalf. Workload Binding binds the managed-agent identity and selected caller-context claims into the outbound Verifiable Presentation injected by a Transit Point.
Credential Delegation
The Credential Delegation element binds external credential providers (OAuth, API key) to a surface so the gateway attaches cached tokens to outbound calls on the caller’s behalf. When no token is held for a given caller, the gateway signals consent_required back rather than forwarding the request.
Drop it on the Managed Agent → External request edge. One element per surface (singleton).
Credential delegation requires both a Caller Context element and at least one Identity element to be configured on the surface. The gateway binds tokens to an authenticated caller identity and a managed-agent workload. Both are required.
Fields
Each row in the outbound credential binding list configures one credential provider.
| Field | Type | Required | Default | Description |
|---|---|---|---|---|
| Credential Provider | select | Yes | — | The credential provider supplying the token. Select from providers managed at Security → Credential Providers. |
| Scopes | string | No | — | Space- or comma-separated OAuth scopes to request when acquiring a token for the caller. |
| Consent mode | select | No | On demand | How the gateway handles a missing token. Options: On demand (signals consent_required back to the caller), Pre-authorize (blocks the request until consent is granted), Elicit (sends an MCP elicitation prompt to the caller). |
| Elicit timeout | integer | Yes (when Consent mode = Elicit) | 300 | Seconds to wait for the caller to complete the elicitation prompt before applying the fallback. |
| Elicit fallback | select | Yes (when Consent mode = Elicit) | On demand | What the gateway does when the caller does not support elicitation. Options: On demand (signals consent_required), Fail (returns not_applicable). |
| Required for | select | No | All outbound requests | Which requests trigger credential injection. Options: All outbound requests, Specific MCP tools only. |
| Required for tools | string | Yes (when Required for = Specific MCP tools only) | — | Comma-separated MCP tool names. The gateway only injects the credential when one of these tools is called. |
| Inject as | select | No | Bearer header | How the token is attached to the outbound request. Options: Bearer header (Authorization: Bearer <token>), Custom header (a named HTTP header), JSON-RPC _meta (a field in the JSON-RPC _meta object). |
| Header name | string | Yes (when Inject as = Custom header) | — | The HTTP header name to write the token into. |
| Header format | string | No (when Inject as = Custom header) | token {value} | Template for the header value. {value} is replaced with the token at injection time. |
| Meta field name | string | Yes (when Inject as = JSON-RPC _meta) | — | The _meta field name to write the token into. |
Workload Binding
The Workload Binding element binds the managed-agent identity and a chosen set of caller-context claims into the outbound Verifiable Presentation (agent-identity-credential/v1) injected by a Transit Point. A downstream Trust Gateway can then verify which workload is acting and on whose behalf it is acting.
Drop it on the Managed Agent → Transit Point request edge. Each Transit Point can carry its own Workload Binding.
Fields
| Field | Type | Required | Default | Description |
|---|---|---|---|---|
| Enable workload binding | bool | No | On | Activates the binding for this Transit Point or target leg. When off, no VP is injected. |
| Caller context source | select | No | Transit token | Where caller claims are read from. Options: Transit token (claims from the signed transit token presented to this Transit Point), Authorization bearer JWT (claims from the inbound Authorization: Bearer JWT). On the MA → External leg, this field is fixed to Authorization bearer JWT. |
| Caller field allowlist | string[] | No | [] | Top-level caller claim names copied into the binding VP. Only listed names cross the boundary. Leave empty to bind no caller claims. Nested paths (a.b) are not supported. |
| Chain caller-supplied credentials | bool | No | Off | When on, a caller-presented VC or VP is chained into the binding VP so the downstream gateway sees the full delegation chain. |
Related
- Caller Context element: required dependency for Credential Delegation.
- Identity element: required dependency for Credential Delegation; the Managed Agent → Transit Point placement populates the managed-agent identity used by Workload Binding.
- Transit Points reference: the Transit Point that receives the bound VP.
Glad to hear it! Please tell us how we can improve more.
Sorry to hear that. Please tell us how we can improve.
Thank you for sharing your feedback so we can improve your experience.