Outbound binding elements
Two canvas elements bind outbound context to upstream requests. Credential Delegation injects cached OAuth or API key tokens from a credential provider into calls on the caller’s behalf. Workload Binding binds the managed-agent identity and selected caller-context claims into the outbound Verifiable Presentation injected on an outbound edge.
Credential Delegation
The Credential Delegation element binds external credential providers (OAuth, API key) to a surface so the gateway attaches cached tokens to outbound calls on the caller’s behalf. When no token is held for a given caller, the gateway signals consent_required back rather than forwarding the request.
Drop it on the Managed Agent → External request edge. One element per surface (singleton).
Credential delegation requires both a Caller Context element and at least one Identity element to be configured on the surface. The gateway binds tokens to an authenticated caller identity and a managed-agent workload. Both are required.
Fields
Each row in the outbound credential binding list configures one credential provider.
| Field | Type | Required | Default | Description |
|---|---|---|---|---|
| Credential Provider | select | Yes | — | The credential provider supplying the token. Select from providers managed at Security → Credential Providers. |
| Scopes | string | No | — | Space- or comma-separated OAuth scopes to request when acquiring a token for the caller. |
| Consent mode | select | No | On demand | How the gateway handles a missing token. Options: On demand (signals consent_required back to the caller), Pre-authorize (blocks the request until consent is granted), Elicit (sends an MCP elicitation prompt to the caller). |
| Elicit timeout | integer | Yes (when Consent mode = Elicit) | 300 | Seconds to wait for the caller to complete the elicitation prompt before applying the fallback. |
| Fallback when client doesn’t support elicitation | select | Yes (when Consent mode = Elicit) | On demand | What the gateway does when the caller does not support elicitation. Options: On demand (signals consent_required), Fail (returns not_applicable). |
| Required for | select | No | All outbound requests | Which requests trigger credential injection. Options: All outbound requests, Specific MCP tools only. |
| Required for tools | string | Yes (when Required for = Specific MCP tools only) | — | Comma-separated MCP tool names. The gateway only injects the credential when one of these tools is called. |
| Inject as | select | No | Bearer header | How the token is attached to the outbound request. Options: Bearer header (Authorization: Bearer <token>), Custom header (a named HTTP header), JSON-RPC _meta (a field in the JSON-RPC _meta object). |
| Header name | string | Yes (when Inject as = Custom header) | — | The HTTP header name to write the token into. |
| Header format | string | No (when Inject as = Custom header) | token {value} | Template for the header value. {value} is replaced with the token at injection time. |
| Meta field name | string | Yes (when Inject as = JSON-RPC _meta) | — | The _meta field name to write the token into. |
Workload Binding
The Workload Binding element binds the managed-agent identity and a chosen set of caller-context claims into the outbound Verifiable Presentation (agent-identity-credential/v1) injected on an outbound edge. A downstream Agent Gateway can then verify which workload is acting and on whose behalf it is acting.
Drop it on a Managed Agent → Transit Point or Managed Agent → External edge. Each Transit Point or target leg can carry its own Workload Binding configuration.
Fields
| Field | Type | Required | Default | Description |
|---|---|---|---|---|
| Enable workload binding | bool | No | On | Activates the binding for this Transit Point or target leg. When off, no VP is injected. |
| Caller context source | select | No | Transit token | Where caller claims are read from. Options: Transit token (claims from the signed transit token presented to this Transit Point), Authorization bearer JWT (claims from the inbound Authorization: Bearer JWT), DID authentication (the resolved DID from a DID-authenticated session becomes the caller identity; requires the Caller Context element on this surface to use the DID Auth method). On the MA → External leg, Transit token is not offered since there is no transit token on that leg; the choice there is between Authorization bearer JWT and DID authentication. |
| Caller field allowlist | string[] | No | [] | Top-level caller claim names copied into the binding VP. Only listed names cross the boundary. Leave empty to bind no caller claims. Nested paths (a.b) are not supported. |
| Chain caller-supplied credentials | bool | No | Off | When on, a caller-presented VC or VP is chained into the binding VP so the downstream gateway sees the full delegation chain. |
Related
- Caller Context element: required dependency for Credential Delegation, and for Workload Binding when Caller context source is set to DID authentication.
- Identity element: required dependency for Credential Delegation; the Managed Agent → Transit Point placement populates the managed-agent identity used by Workload Binding.
- Transit Points reference: the outbound edge that carries the bound VP.
Glad to hear it. Thanks for letting us know.
Sorry to hear that. Thanks for letting us know.