Agents

An agent is an AI worker with its own identity. It pairs a model configuration (provider, model, version) with a registered identity in your identity provider, so everything the agent does is attributable to the agent acting on behalf of a user — never to an anonymous API key.

What creating an agent does

When you create an agent, Agentfleet:

1. Registers it in the identity provider as a delegated agent — it can only ever act on behalf of a delegating user, not independently.
2. Creates a confidential client for it with no client secret. The agent authenticates using private_key_jwt — short-lived assertions signed with a per-agent key held in a key vault. Private key material never touches the application.
3. Records the model it runs on (version one runs agents on the Groq provider).

Lifecycle

State	Meaning
Active	Can be assigned to runs.
Inactive	Deactivated; existing history is preserved, no new runs.
Deleted	Soft-deleted.

Activate, deactivate, and delete from the agent's page. Updates to name, description, or model propagate to the identity provider registration.

Key rotation

Each agent's signing key can be rotated with zero downtime: a new key version is minted and registered while the previous one remains valid during the overlap window, then superseded keys are revoked. Rotate keys on your normal credential-rotation cadence or immediately on suspicion of compromise.

Agent instances

You never run "the agent" directly. Each step of each run creates an agent instance — a single, short-lived execution with its own delegated token, its own lifecycle (Idle → Running → Completed/Failed/ Cancelled), and its own audit trail. This is what makes runs individually attributable and revocable.

Related

• Identity & Security — what the delegated token carries.
• Runs — how agent instances fit into a run.