Identity

Without strong identity, agents run as anonymous super-users or share one API key. You cannot enforce RBAC, audit who did what, or revoke access when someone leaves the company.

A corporate ID badge that also limits which doors open — not a shared master key taped under the reception desk.

Scenario

An employee opens the internal copilot; OIDC login yields a JWT with `groups: ['engineering']`. The agent uses that token to call GitHub as the user (not as a bot with org-wide admin) and only sees repos the user already has access to.

Solution

In Enterprise AI, apply Identity to this scenario: An employee opens the internal copilot; OIDC login yields a JWT with `groups: ['engineering']`. Identify the inputs, run the technique, validate the output, and note one thing you would monitor in production.

Do this before moving to the next module — reading alone is not enough.

Open the Code Walkthrough below and run it locally. Change one parameter related to Identity (e.g. model, temperature, top_k, or tool name), observe the difference in output, and write 2–3 sentences explaining what changed.

Highlighted lines show where Identity happens in the code.

1// OIDC middleware — attach identity to agent context  # key line for Identity2app.use(async (req, res, next) => {3  const token = req.headers.authorization?.replace("Bearer ", "");4  const claims = await oidc.verify(token);5  req.agentContext = {6    userId: claims.sub,7    tenantId: claims.tid,8    roles: claims.groups ?? [],9    sessionId: crypto.randomUUID(),10  };11  next();12});

• Treating Identity as a black box without evaluation
• Ignoring cost and latency in production
• Skipping error handling for identity

Quick recap — the most important points from this module.