Agentic identity: modeling agents to keep users in control

Summary

Ramp for Agents adds CLI and MCP interfaces through which AI agents can manage cards, bills, expenses, and approvals, creating a need to represent agents as accountable actors instead of handing them users’ session tokens or API keys. The initial identity model links a named Agent Key to a human sponsor and business, bounds scopes by the sponsor’s role, records agent attribution, and adds expiration and revocation. Ramp extends RBAC and its DenormalizedActor audit model with AgentContext, so logs, approvals, and webhooks can distinguish “Sarah (via Codex)” while reusing existing permissioning and rendering paths. OAuth2-PKCE exchanges the Agent Key for short-lived access and refresh tokens, with re-validation during refresh to limit leaked-credential exposure and preserve session traceability. The first release uses on-behalf-of-user agents because they fit current demand and keep a human accountable, while admins can oversee keys or disable agent access for roles and groups.

Context

AI agents can manage money across Ramp cards, bills, expenses, and approvals, but directly giving an agent a user’s session token or API key would obscure attribution, provide the user’s full permissions, and leave access without clear lifecycle controls.

Approach / What changed

Ramp models agents as on-behalf-of-user identities linked to human sponsors. Agent Keys define scoped authority and lifecycle controls, while RBAC, AgentContext, and OAuth2-PKCE provide bounded permissions, attribution, auditability, expiration, revocation, and short-lived access tokens.

Takeaways

• The first release chooses OBOU over Standalone Agents because current demand is OBOU-shaped and existing auditing and permissioning can be reused; even business-level management can be modeled through an admin sponsor.
• Agent Keys are OAuth Key IDs for PKCE, not API keys or authentication material. Leaking an Agent Key alone does not grant access, while access tokens can expire and be revoked.
• Every Agent Key expires by default, with renewal reminders and notifications for creation, expiration, and revocation. Admins can view, revoke, or expire any user key and disable agent-key creation for roles or groups.

Related reading