PyPI - solace-agent-mesh - Versions diffs - 1.6.1__py3-none-any.whl → 1.13.2__py3-none-any.whl - Mend - Supply Chain Defender

solace-agent-mesh 1.6.1py3-none-any.whl → 1.13.2py3-none-any.whl

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Potentially problematic release.

This version of solace-agent-mesh might be problematic. Click here for more details.

Files changed (481) hide show

solace_agent_mesh/assets/docs/docs/documentation/enterprise/secure-user-delegated-access/index.html ADDED Viewed

@@ -0,0 +1,440 @@
+<!doctype html>
+<html lang="en" dir="ltr" class="docs-wrapper plugin-docs plugin-id-default docs-version-current docs-doc-page docs-doc-id-documentation/enterprise/secure-user-delegated-access" data-has-hydrated="false">
+<head>
+<meta charset="UTF-8">
+<meta name="generator" content="Docusaurus v3.9.2">
+<title data-rh="true">Secure User Delegated Access | Solace Agent Mesh</title><meta data-rh="true" name="viewport" content="width=device-width,initial-scale=1"><meta data-rh="true" name="twitter:card" content="summary_large_image"><meta data-rh="true" property="og:image" content="https://solacelabs.github.io/solace-agent-mesh/img/logo.png"><meta data-rh="true" name="twitter:image" content="https://solacelabs.github.io/solace-agent-mesh/img/logo.png"><meta data-rh="true" property="og:url" content="https://solacelabs.github.io/solace-agent-mesh/docs/documentation/enterprise/secure-user-delegated-access"><meta data-rh="true" property="og:locale" content="en"><meta data-rh="true" name="docusaurus_locale" content="en"><meta data-rh="true" name="docsearch:language" content="en"><meta data-rh="true" name="docusaurus_version" content="current"><meta data-rh="true" name="docusaurus_tag" content="docs-default-current"><meta data-rh="true" name="docsearch:version" content="current"><meta data-rh="true" name="docsearch:docusaurus_tag" content="docs-default-current"><meta data-rh="true" property="og:title" content="Secure User Delegated Access | Solace Agent Mesh"><meta data-rh="true" name="description" content="This guide walks you through configuring Secure User Delegated Access for Agent Mesh Enterprise. You will learn how to enable users to authenticate with remote MCP tools using their own credentials through OAuth2, providing enhanced security and user-specific access control."><meta data-rh="true" property="og:description" content="This guide walks you through configuring Secure User Delegated Access for Agent Mesh Enterprise. You will learn how to enable users to authenticate with remote MCP tools using their own credentials through OAuth2, providing enhanced security and user-specific access control."><link data-rh="true" rel="icon" href="/solace-agent-mesh/img/logo.png"><link data-rh="true" rel="canonical" href="https://solacelabs.github.io/solace-agent-mesh/docs/documentation/enterprise/secure-user-delegated-access"><link data-rh="true" rel="alternate" href="https://solacelabs.github.io/solace-agent-mesh/docs/documentation/enterprise/secure-user-delegated-access" hreflang="en"><link data-rh="true" rel="alternate" href="https://solacelabs.github.io/solace-agent-mesh/docs/documentation/enterprise/secure-user-delegated-access" hreflang="x-default"><script data-rh="true" type="application/ld+json">{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Agent Mesh Enterprise","item":"https://solacelabs.github.io/solace-agent-mesh/docs/documentation/enterprise/"},{"@type":"ListItem","position":2,"name":"Secure User Delegated Access","item":"https://solacelabs.github.io/solace-agent-mesh/docs/documentation/enterprise/secure-user-delegated-access"}]}</script><link rel="stylesheet" href="/solace-agent-mesh/assets/css/styles.8162edfb.css">
+<script src="/solace-agent-mesh/assets/js/runtime~main.27bb82a7.js" defer="defer"></script>
+<script src="/solace-agent-mesh/assets/js/main.d634009f.js" defer="defer"></script>
+</head>
+<body class="navigation-with-keyboard">
+<svg style="display: none;"><defs>
+<symbol id="theme-svg-external-link" viewBox="0 0 24 24"><path fill="currentColor" d="M21 13v10h-21v-19h12v2h-10v15h17v-8h2zm3-12h-10.988l4.035 4-6.977 7.07 2.828 2.828 6.977-7.07 4.125 4.172v-11z"/></symbol>
+</defs></svg>
+<script>!function(){var t=function(){try{return new URLSearchParams(window.location.search).get("docusaurus-theme")}catch(t){}}()||function(){try{return window.localStorage.getItem("theme")}catch(t){}}();document.documentElement.setAttribute("data-theme",t||(window.matchMedia("(prefers-color-scheme: dark)").matches?"dark":"light")),document.documentElement.setAttribute("data-theme-choice",t||"system")}(),function(){try{const c=new URLSearchParams(window.location.search).entries();for(var[t,e]of c)if(t.startsWith("docusaurus-data-")){var a=t.replace("docusaurus-data-","data-");document.documentElement.setAttribute(a,e)}}catch(t){}}()</script><div id="__docusaurus"><link rel="preload" as="image" href="/solace-agent-mesh/img/logo.png"><link rel="preload" as="image" href="/solace-agent-mesh/img/solace-logo.png"><div role="region" aria-label="Skip to main content"><a class="skipToContent_fXgn" href="#__docusaurus_skipToContent_fallback">Skip to main content</a></div><nav aria-label="Main" class="theme-layout-navbar navbar navbar--fixed-top"><div class="navbar__inner"><div class="theme-layout-navbar-left navbar__items"><button aria-label="Toggle navigation bar" aria-expanded="false" class="navbar__toggle clean-btn" type="button"><svg width="30" height="30" viewBox="0 0 30 30" aria-hidden="true"><path stroke="currentColor" stroke-linecap="round" stroke-miterlimit="10" stroke-width="2" d="M4 7h22M4 15h22M4 23h22"></path></svg></button><a class="navbar__brand" href="/solace-agent-mesh/docs/documentation/getting-started"><div class="navbar__logo"><img src="/solace-agent-mesh/img/logo.png" alt="Solace Agent Mesh Logo" class="themedComponent_mlkZ themedComponent--light_NVdE"><img src="/solace-agent-mesh/img/logo.png" alt="Solace Agent Mesh Logo" class="themedComponent_mlkZ themedComponent--dark_xIcU"></div><b class="navbar__title text--truncate">Solace Agent Mesh</b></a><a aria-current="page" class="navbar__item navbar__link navbar__link--active" href="/solace-agent-mesh/docs/documentation/getting-started/">Documentation</a></div><div class="theme-layout-navbar-right navbar__items navbar__items--right"><a href="https://github.com/SolaceLabs/solace-agent-mesh/" target="_blank" rel="noopener noreferrer" class="navbar__item navbar__link">GitHub<svg width="13.5" height="13.5" aria-label="(opens in new tab)" class="iconExternalLink_nPIU"><use href="#theme-svg-external-link"></use></svg></a><div class="toggle_vylO colorModeToggle_DEke"><button class="clean-btn toggleButton_gllP toggleButtonDisabled_aARS" type="button" disabled="" title="system mode" aria-label="Switch between dark and light mode (currently system mode)"><svg viewBox="0 0 24 24" width="24" height="24" aria-hidden="true" class="toggleIcon_g3eP lightToggleIcon_pyhR"><path fill="currentColor" d="M12,9c1.65,0,3,1.35,3,3s-1.35,3-3,3s-3-1.35-3-3S10.35,9,12,9 M12,7c-2.76,0-5,2.24-5,5s2.24,5,5,5s5-2.24,5-5 S14.76,7,12,7L12,7z M2,13l2,0c0.55,0,1-0.45,1-1s-0.45-1-1-1l-2,0c-0.55,0-1,0.45-1,1S1.45,13,2,13z M20,13l2,0c0.55,0,1-0.45,1-1 s-0.45-1-1-1l-2,0c-0.55,0-1,0.45-1,1S19.45,13,20,13z M11,2v2c0,0.55,0.45,1,1,1s1-0.45,1-1V2c0-0.55-0.45-1-1-1S11,1.45,11,2z M11,20v2c0,0.55,0.45,1,1,1s1-0.45,1-1v-2c0-0.55-0.45-1-1-1C11.45,19,11,19.45,11,20z M5.99,4.58c-0.39-0.39-1.03-0.39-1.41,0 c-0.39,0.39-0.39,1.03,0,1.41l1.06,1.06c0.39,0.39,1.03,0.39,1.41,0s0.39-1.03,0-1.41L5.99,4.58z M18.36,16.95 c-0.39-0.39-1.03-0.39-1.41,0c-0.39,0.39-0.39,1.03,0,1.41l1.06,1.06c0.39,0.39,1.03,0.39,1.41,0c0.39-0.39,0.39-1.03,0-1.41 L18.36,16.95z M19.42,5.99c0.39-0.39,0.39-1.03,0-1.41c-0.39-0.39-1.03-0.39-1.41,0l-1.06,1.06c-0.39,0.39-0.39,1.03,0,1.41 s1.03,0.39,1.41,0L19.42,5.99z M7.05,18.36c0.39-0.39,0.39-1.03,0-1.41c-0.39-0.39-1.03-0.39-1.41,0l-1.06,1.06 c-0.39,0.39-0.39,1.03,0,1.41s1.03,0.39,1.41,0L7.05,18.36z"></path></svg><svg viewBox="0 0 24 24" width="24" height="24" aria-hidden="true" class="toggleIcon_g3eP darkToggleIcon_wfgR"><path fill="currentColor" d="M9.37,5.51C9.19,6.15,9.1,6.82,9.1,7.5c0,4.08,3.32,7.4,7.4,7.4c0.68,0,1.35-0.09,1.99-0.27C17.45,17.19,14.93,19,12,19 c-3.86,0-7-3.14-7-7C5,9.07,6.81,6.55,9.37,5.51z M12,3c-4.97,0-9,4.03-9,9s4.03,9,9,9s9-4.03,9-9c0-0.46-0.04-0.92-0.1-1.36 c-0.98,1.37-2.58,2.26-4.4,2.26c-2.98,0-5.4-2.42-5.4-5.4c0-1.81,0.89-3.42,2.26-4.4C12.92,3.04,12.46,3,12,3L12,3z"></path></svg><svg viewBox="0 0 24 24" width="24" height="24" aria-hidden="true" class="toggleIcon_g3eP systemToggleIcon_QzmC"><path fill="currentColor" d="m12 21c4.971 0 9-4.029 9-9s-4.029-9-9-9-9 4.029-9 9 4.029 9 9 9zm4.95-13.95c1.313 1.313 2.05 3.093 2.05 4.95s-0.738 3.637-2.05 4.95c-1.313 1.313-3.093 2.05-4.95 2.05v-14c1.857 0 3.637 0.737 4.95 2.05z"></path></svg></button></div><div class="navbarSearchContainer_Bca1"><div class="navbar__search"><span aria-label="expand searchbar" role="button" class="search-icon" tabindex="0"></span><input id="search_input_react" type="search" placeholder="Loading..." aria-label="Search" class="navbar__search-input search-bar" disabled=""></div></div></div></div><div role="presentation" class="navbar-sidebar__backdrop"></div></nav><div id="__docusaurus_skipToContent_fallback" class="theme-layout-main main-wrapper mainWrapper_z2l0"><div class="docsWrapper_hBAB"><button aria-label="Scroll back to top" class="clean-btn theme-back-to-top-button backToTopButton_sjWU" type="button"></button><div class="docRoot_UBD9"><aside class="theme-doc-sidebar-container docSidebarContainer_YfHR"><div class="sidebarViewport_aRkj"><div class="sidebar_njMd"><nav aria-label="Docs sidebar" class="menu thin-scrollbar menu_SIkG"><ul class="theme-doc-sidebar-menu menu__list"><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item"><div class="menu__list-item-collapsible"><a class="categoryLink_byQd menu__link menu__link--sublist" href="/solace-agent-mesh/docs/documentation/getting-started/"><span title="Getting Started" class="categoryLinkLabel_W154">Getting Started</span></a><button aria-label="Collapse sidebar category &#x27;Getting Started&#x27;" aria-expanded="true" type="button" class="clean-btn menu__caret"></button></div><ul class="menu__list"><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/solace-agent-mesh/docs/documentation/getting-started/introduction"><span title="What is Agent Mesh?" class="linkLabel_WmDU">What is Agent Mesh?</span></a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/solace-agent-mesh/docs/documentation/getting-started/try-agent-mesh"><span title="Try Agent Mesh" class="linkLabel_WmDU">Try Agent Mesh</span></a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/solace-agent-mesh/docs/documentation/getting-started/architecture"><span title="Architecture Overview" class="linkLabel_WmDU">Architecture Overview</span></a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/solace-agent-mesh/docs/documentation/getting-started/vibe_coding"><span title="Vibe Coding" class="linkLabel_WmDU">Vibe Coding</span></a></li></ul></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="categoryLink_byQd menu__link menu__link--sublist" href="/solace-agent-mesh/docs/documentation/components/"><span title="Components" class="categoryLinkLabel_W154">Components</span></a><button aria-label="Expand sidebar category &#x27;Components&#x27;" aria-expanded="false" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="categoryLink_byQd menu__link menu__link--sublist" href="/solace-agent-mesh/docs/documentation/installing-and-configuring/"><span title="Installing and Configuring Agent Mesh" class="categoryLinkLabel_W154">Installing and Configuring Agent Mesh</span></a><button aria-label="Expand sidebar category &#x27;Installing and Configuring Agent Mesh&#x27;" aria-expanded="false" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="categoryLink_byQd menu__link menu__link--sublist" href="/solace-agent-mesh/docs/documentation/developing/"><span title="Developing with Agent Mesh" class="categoryLinkLabel_W154">Developing with Agent Mesh</span></a><button aria-label="Expand sidebar category &#x27;Developing with Agent Mesh&#x27;" aria-expanded="false" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="categoryLink_byQd menu__link menu__link--sublist" href="/solace-agent-mesh/docs/documentation/deploying/"><span title="Deploying Agent Mesh" class="categoryLinkLabel_W154">Deploying Agent Mesh</span></a><button aria-label="Expand sidebar category &#x27;Deploying Agent Mesh&#x27;" aria-expanded="false" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="categoryLink_byQd menu__link menu__link--sublist menu__link--sublist-caret" role="button" aria-expanded="false" href="/solace-agent-mesh/docs/documentation/migrations/platform-service-split"><span title="Migrations" class="categoryLinkLabel_W154">Migrations</span></a></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item"><div class="menu__list-item-collapsible"><a class="categoryLink_byQd menu__link menu__link--sublist menu__link--active" href="/solace-agent-mesh/docs/documentation/enterprise/"><span title="Agent Mesh Enterprise" class="categoryLinkLabel_W154">Agent Mesh Enterprise</span></a><button aria-label="Collapse sidebar category &#x27;Agent Mesh Enterprise&#x27;" aria-expanded="true" type="button" class="clean-btn menu__caret"></button></div><ul class="menu__list"><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/solace-agent-mesh/docs/documentation/enterprise/installation"><span title="Installing Agent Mesh Enterprise" class="linkLabel_WmDU">Installing Agent Mesh Enterprise</span></a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/solace-agent-mesh/docs/documentation/enterprise/wheel-installation"><span title="Running from Wheel File" class="linkLabel_WmDU">Running from Wheel File</span></a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/solace-agent-mesh/docs/documentation/enterprise/agent-builder"><span title="Agent Builder" class="linkLabel_WmDU">Agent Builder</span></a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/solace-agent-mesh/docs/documentation/enterprise/connectors/"><span title="Connectors" class="linkLabel_WmDU">Connectors</span></a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/solace-agent-mesh/docs/documentation/enterprise/rbac-setup-guide"><span title="Setting Up RBAC" class="linkLabel_WmDU">Setting Up RBAC</span></a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/solace-agent-mesh/docs/documentation/enterprise/single-sign-on"><span title="Enabling SSO" class="linkLabel_WmDU">Enabling SSO</span></a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link menu__link--active" aria-current="page" tabindex="0" href="/solace-agent-mesh/docs/documentation/enterprise/secure-user-delegated-access"><span title="Secure User Delegated Access" class="linkLabel_WmDU">Secure User Delegated Access</span></a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/solace-agent-mesh/docs/documentation/enterprise/openapi-tools"><span title="OpenAPI Tools" class="linkLabel_WmDU">OpenAPI Tools</span></a></li></ul></li></ul></nav></div></div></aside><main class="docMainContainer_TBSr"><div class="container padding-top--md padding-bottom--lg"><div class="row"><div class="col docItemCol_VOVn"><div class="docItemContainer_Djhp"><article><nav class="theme-doc-breadcrumbs breadcrumbsContainer_Z_bl" aria-label="Breadcrumbs"><ul class="breadcrumbs"><li class="breadcrumbs__item"><a class="breadcrumbs__link" href="/solace-agent-mesh/docs/documentation/enterprise/"><span>Agent Mesh Enterprise</span></a></li><li class="breadcrumbs__item breadcrumbs__item--active"><span class="breadcrumbs__link">Secure User Delegated Access</span></li></ul></nav><div class="tocCollapsible_ETCw theme-doc-toc-mobile tocMobile_ITEo"><button type="button" class="clean-btn tocCollapsibleButton_TO0P">On this page</button></div><div class="theme-doc-markdown markdown"><header><h1>Secure User Delegated Access</h1></header><p>This guide walks you through configuring Secure User Delegated Access for Agent Mesh Enterprise. You will learn how to enable users to authenticate with remote MCP tools using their own credentials through OAuth2, providing enhanced security and user-specific access control.</p>
+<h2 class="anchor anchorTargetStickyNavbar_Vzrq" id="table-of-contents">Table of Contents<a href="#table-of-contents" class="hash-link" aria-label="Direct link to Table of Contents" title="Direct link to Table of Contents" translate="no"></a></h2>
+<ul>
+<li class=""><a href="#overview" class="">Overview</a></li>
+<li class=""><a href="#understanding-secure-user-delegated-access" class="">Understanding Secure User Delegated Access</a></li>
+<li class=""><a href="#prerequisites" class="">Prerequisites</a></li>
+<li class=""><a href="#configuration-steps" class="">Configuration Steps</a></li>
+<li class=""><a href="#security-considerations" class="">Security Considerations</a></li>
+<li class=""><a href="#best-practices" class="">Best Practices</a></li>
+<li class=""><a href="#troubleshooting" class="">Troubleshooting</a></li>
+</ul>
+<h2 class="anchor anchorTargetStickyNavbar_Vzrq" id="overview">Overview<a href="#overview" class="hash-link" aria-label="Direct link to Overview" title="Direct link to Overview" translate="no"></a></h2>
+<p>Secure User Delegated Access allows users to interact with remote MCP (Model Context Protocol) tools using their own credentials rather than shared service credentials. When a user needs to access a remote MCP tool configured in an agent, they complete an OAuth2 authentication flow with the MCP provider&#x27;s authorization server. This provides user-specific credentials that are securely stored and managed by Agent Mesh Enterprise.</p>
+<h3 class="anchor anchorTargetStickyNavbar_Vzrq" id="why-use-secure-user-delegated-access">Why Use Secure User Delegated Access<a href="#why-use-secure-user-delegated-access" class="hash-link" aria-label="Direct link to Why Use Secure User Delegated Access" title="Direct link to Why Use Secure User Delegated Access" translate="no"></a></h3>
+<p>This feature provides several important benefits for enterprise deployments:</p>
+<p><strong>Enhanced Security</strong>: Each user authenticates with their own credentials, eliminating shared service accounts and reducing the blast radius of compromised credentials. All API calls to remote services are made in the context of the authenticated user.</p>
+<p><strong>Audit and Compliance</strong>: User-specific credentials create clear audit trails showing exactly which user performed which actions. This is essential for compliance requirements and security investigations.</p>
+<p><strong>Fine-Grained Access Control</strong>: MCP providers can enforce their own access policies based on the authenticated user&#x27;s permissions. Users only access resources they are authorized to use within the remote service.</p>
+<p><strong>Credential Lifecycle Management</strong>: User credentials can be individually revoked at the MCP provider level without affecting other users. This simplifies offboarding and incident response.</p>
+<h3 class="anchor anchorTargetStickyNavbar_Vzrq" id="supported-mcp-providers">Supported MCP Providers<a href="#supported-mcp-providers" class="hash-link" aria-label="Direct link to Supported MCP Providers" title="Direct link to Supported MCP Providers" translate="no"></a></h3>
+<p>Agent Mesh Enterprise supports remote MCP servers that implement the OAuth2.1 authentication flow. The following providers have been tested and validated:</p>
+<ul>
+<li class=""><strong>Atlassian MCP Server</strong>: Access Jira, Confluence, and other Atlassian services</li>
+<li class=""><strong>Stripe MCP Server</strong>: Interact with Stripe payment and billing APIs</li>
+<li class=""><strong>Cloudflare MCP Server</strong>: Manage Cloudflare resources and configurations</li>
+<li class=""><strong>Canva MCP Server</strong>: Access Canva design and content APIs</li>
+</ul>
+<p>The feature works with both SSE (Server-Sent Events) and HTTP streaming remote MCP server types.</p>
+<h2 class="anchor anchorTargetStickyNavbar_Vzrq" id="understanding-secure-user-delegated-access">Understanding Secure User Delegated Access<a href="#understanding-secure-user-delegated-access" class="hash-link" aria-label="Direct link to Understanding Secure User Delegated Access" title="Direct link to Understanding Secure User Delegated Access" translate="no"></a></h2>
+<p>Before you configure this feature, you need to understand how it works and how credentials flow through the system.</p>
+<h3 class="anchor anchorTargetStickyNavbar_Vzrq" id="how-the-oauth2-flow-works">How the OAuth2 Flow Works<a href="#how-the-oauth2-flow-works" class="hash-link" aria-label="Direct link to How the OAuth2 Flow Works" title="Direct link to How the OAuth2 Flow Works" translate="no"></a></h3>
+<p>When a user attempts to use an MCP tool that requires OAuth2 authentication, Agent Mesh Enterprise initiates the following flow:</p>
+<ol>
+<li class="">
+<p><strong>Authentication Challenge</strong>: The user&#x27;s request triggers an authentication check. If no valid credentials exist for this user and MCP tool combination, the system prompts the user to authenticate.</p>
+</li>
+<li class="">
+<p><strong>OAuth2 Authorization</strong>: The user is redirected to the MCP provider&#x27;s authorization server (for example, Atlassian or Stripe). The user logs in using their credentials for that service and grants permission for Agent Mesh Enterprise to access their resources.</p>
+</li>
+<li class="">
+<p><strong>Authorization Code Exchange</strong>: After successful authentication, the provider redirects back to Agent Mesh Enterprise with an authorization code. The system exchanges this code for access tokens at the provider&#x27;s token endpoint.</p>
+</li>
+<li class="">
+<p><strong>Credential Storage</strong>: Agent Mesh Enterprise stores the access token (and refresh token if provided) in the credential service. Credentials are encrypted at rest (when using a database) and isolated per agent, user, and MCP tool.</p>
+</li>
+<li class="">
+<p><strong>Authenticated Requests</strong>: Subsequent requests to the MCP tool use the stored credentials automatically. The user does not need to re-authenticate unless credentials expire or are revoked.</p>
+</li>
+<li class="">
+<p><strong>Token Refresh</strong>: If the MCP provider supports refresh tokens and an access token expires, Agent Mesh Enterprise automatically obtains a new access token without requiring user interaction.</p>
+</li>
+</ol>
+<p>From an administrator&#x27;s perspective, this flow is transparent once configured. Users experience a one-time authentication prompt per MCP tool, after which their access works seamlessly.</p>
+<h3 class="anchor anchorTargetStickyNavbar_Vzrq" id="credential-storage">Credential Storage<a href="#credential-storage" class="hash-link" aria-label="Direct link to Credential Storage" title="Direct link to Credential Storage" translate="no"></a></h3>
+<p>Agent Mesh Enterprise manages user credentials through a dedicated credential service with several important characteristics:</p>
+<p><strong>Encryption at Rest</strong>: When using database persistence, all stored credentials are automatically encrypted using the agent&#x27;s unique identifier as the encryption key. This ensures that credentials cannot be used if extracted from database storage. Memory-based storage does not persist credentials to disk.</p>
+<p><strong>Multi-Tenant Isolation</strong>: Credentials are scoped to the combination of agent ID, user identity, and MCP tool. Credentials for one agent cannot be accessed by another agent, even for the same user and tool. This provides strong isolation in multi-tenant deployments.</p>
+<p><strong>Configurable Expiration</strong>: You can configure a time-to-live (TTL) for stored credentials. After the TTL expires, Agent Mesh Enterprise removes credentials from storage, requiring users to re-authenticate. This reduces the risk of long-lived credential compromise.</p>
+<p><strong>Persistence Options</strong>: Credentials can be stored in memory (for development or ephemeral deployments) or in a database (for production deployments where credentials should survive agent restarts).</p>
+<h3 class="anchor anchorTargetStickyNavbar_Vzrq" id="credential-lifecycle">Credential Lifecycle<a href="#credential-lifecycle" class="hash-link" aria-label="Direct link to Credential Lifecycle" title="Direct link to Credential Lifecycle" translate="no"></a></h3>
+<p>Understanding the credential lifecycle helps you plan operational procedures:</p>
+<ol>
+<li class="">
+<p><strong>Acquisition</strong>: Credentials are acquired when a user first authenticates with an MCP provider through the OAuth2 flow.</p>
+</li>
+<li class="">
+<p><strong>Active Use</strong>: Stored credentials are used automatically for all subsequent requests to that MCP tool by that user.</p>
+</li>
+<li class="">
+<p><strong>Expiration</strong>: Credentials expire either through TTL timeout (configured by you) or token expiration (set by the MCP provider). Agent Mesh Enterprise attempts to refresh expired tokens if refresh tokens are available.</p>
+</li>
+<li class="">
+<p><strong>Revocation</strong>: Users or administrators can revoke credentials at the MCP provider level. When Agent Mesh Enterprise attempts to use revoked credentials, the request fails and the user must re-authenticate.</p>
+</li>
+<li class="">
+<p><strong>Deletion</strong>: Credentials are marked as deleted when they expire (TTL timeout), but are retained in the persistence layer for audit purposes. With memory storage, credentials are removed from storage when the agent is restarted.</p>
+</li>
+</ol>
+<h2 class="anchor anchorTargetStickyNavbar_Vzrq" id="prerequisites">Prerequisites<a href="#prerequisites" class="hash-link" aria-label="Direct link to Prerequisites" title="Direct link to Prerequisites" translate="no"></a></h2>
+<p>Before you configure Secure User Delegated Access, ensure you have the following in place:</p>
+<h3 class="anchor anchorTargetStickyNavbar_Vzrq" id="mcp-provider-access">MCP Provider Access<a href="#mcp-provider-access" class="hash-link" aria-label="Direct link to MCP Provider Access" title="Direct link to MCP Provider Access" translate="no"></a></h3>
+<p>Some MCP providers require administrative access to authorize Agent Mesh Enterprise before users can authenticate. The requirements vary by provider:</p>
+<p><strong>Example providers requiring domain authorization</strong> (Atlassian, Stripe, Canva):</p>
+<ul>
+<li class="">Administrative access to the MCP provider&#x27;s admin console</li>
+<li class="">Ability to add your Agent Mesh Enterprise domain to the provider&#x27;s authorized domains list</li>
+</ul>
+<p><strong>Example providers without administrative requirements</strong> (Cloudflare):</p>
+<ul>
+<li class="">No administrative setup required</li>
+<li class="">Users can authenticate directly through the OAuth2 flow</li>
+</ul>
+<p>Check the specific requirements for your chosen MCP provider.</p>
+<h3 class="anchor anchorTargetStickyNavbar_Vzrq" id="callback-uri-configuration">Callback URI Configuration<a href="#callback-uri-configuration" class="hash-link" aria-label="Direct link to Callback URI Configuration" title="Direct link to Callback URI Configuration" translate="no"></a></h3>
+<p>Your Agent Mesh Enterprise deployment must be accessible via a stable URL for OAuth2 callbacks. During the OAuth2 flow, users are redirected to the MCP provider for authentication, then redirected back to this callback URI.</p>
+<p>You will configure this callback URI as an environment variable (see <a href="#configure-oauth2-callback-uri" class="">Configure OAuth2 Callback URI</a>). For providers requiring domain authorization (for example: Atlassian, Stripe, Canva), you will also register this domain in the provider&#x27;s admin console.</p>
+<h3 class="anchor anchorTargetStickyNavbar_Vzrq" id="database-setup-for-production">Database Setup (For Production)<a href="#database-setup-for-production" class="hash-link" aria-label="Direct link to Database Setup (For Production)" title="Direct link to Database Setup (For Production)" translate="no"></a></h3>
+<p>For production deployments, you should use SQL persistence to ensure credentials survive agent restarts. You need:</p>
+<ul>
+<li class="">A supported SQL database (SQLite, PostgreSQL, MySQL, or other SQL database supported by SQLAlchemy)</li>
+<li class="">Appropriate database credentials and connection information</li>
+<li class="">Sufficient storage for credential data</li>
+</ul>
+<p>See <a href="#configure-session-service-type" class="">Configure Session Service Type</a> for details on setting up persistence. For development or testing, you can use memory storage, but credentials will be lost when the agent restarts.</p>
+<h2 class="anchor anchorTargetStickyNavbar_Vzrq" id="configuration-steps">Configuration Steps<a href="#configuration-steps" class="hash-link" aria-label="Direct link to Configuration Steps" title="Direct link to Configuration Steps" translate="no"></a></h2>
+<p>Configuring Secure User Delegated Access involves several steps: configuring credential storage and lifecycle, optionally configuring the trust manager for enhanced security, and configuring your MCP tools with OAuth2 authentication.</p>
+<h3 class="anchor anchorTargetStickyNavbar_Vzrq" id="step-1-configure-credential-storage-and-lifecycle">Step 1: Configure Credential Storage and Lifecycle<a href="#step-1-configure-credential-storage-and-lifecycle" class="hash-link" aria-label="Direct link to Step 1: Configure Credential Storage and Lifecycle" title="Direct link to Step 1: Configure Credential Storage and Lifecycle" translate="no"></a></h3>
+<p>The credential service is automatically created and manages storage, retrieval, and lifecycle of user credentials. You configure it through environment variables and your session service configuration.</p>
+<h4 class="anchor anchorTargetStickyNavbar_Vzrq" id="configure-credential-time-to-live">Configure Credential Time-to-Live<a href="#configure-credential-time-to-live" class="hash-link" aria-label="Direct link to Configure Credential Time-to-Live" title="Direct link to Configure Credential Time-to-Live" translate="no"></a></h4>
+<p>Set the credential TTL to control how long credentials remain valid in storage:</p>
+<div class="language-bash codeBlockContainer_Ckt0 theme-code-block" style="--prism-color:#F8F8F2;--prism-background-color:#282A36"><div class="codeBlockContent_QJqH"><pre tabindex="0" class="prism-code language-bash codeBlock_bY9V thin-scrollbar" style="color:#F8F8F2;background-color:#282A36"><code class="codeBlockLines_e6Vv"><span class="token-line" style="color:#F8F8F2"><span class="token plain">export SECRETS_TTL_SECONDS=86400  # 24 hours</span><br></span></code></pre></div></div>
+<p>The TTL value is specified in seconds. Common values include:</p>
+<ul>
+<li class=""><code>3600</code> - 1 hour (high security, frequent re-authentication)</li>
+<li class=""><code>86400</code> - 24 hours (balance of security and convenience)</li>
+<li class=""><code>604800</code> - 7 days (low security, infrequent re-authentication)</li>
+<li class=""><code>2592000</code> - 30 days (default if not specified)</li>
+</ul>
+<p>Choose a TTL based on your security requirements and user experience considerations. Shorter TTLs require users to re-authenticate more frequently but reduce the window of exposure for compromised credentials.</p>
+<h4 class="anchor anchorTargetStickyNavbar_Vzrq" id="configure-oauth2-callback-uri">Configure OAuth2 Callback URI<a href="#configure-oauth2-callback-uri" class="hash-link" aria-label="Direct link to Configure OAuth2 Callback URI" title="Direct link to Configure OAuth2 Callback URI" translate="no"></a></h4>
+<p>Set the callback URI where MCP providers will redirect users after authentication:</p>
+<div class="language-bash codeBlockContainer_Ckt0 theme-code-block" style="--prism-color:#F8F8F2;--prism-background-color:#282A36"><div class="codeBlockContent_QJqH"><pre tabindex="0" class="prism-code language-bash codeBlock_bY9V thin-scrollbar" style="color:#F8F8F2;background-color:#282A36"><code class="codeBlockLines_e6Vv"><span class="token-line" style="color:#F8F8F2"><span class="token plain">export OAUTH_TOOL_REDIRECT_URI=https://my.domain.com/api/v1/auth/tool/callback</span><br></span></code></pre></div></div>
+<p>Replace <code>https://my.domain.com</code> with your actual Agent Mesh Enterprise domain.</p>
+<p><strong>Important</strong>: The path <code>/api/v1/auth/tool/callback</code> must not be changed. This is the required callback endpoint path.</p>
+<p>This URL must:</p>
+<ul>
+<li class="">Match exactly what you register with your MCP provider (for providers requiring domain authorization)</li>
+<li class="">Use HTTPS in production (HTTP is only acceptable for local development)</li>
+<li class="">Be accessible from users&#x27; browsers</li>
+</ul>
+<h4 class="anchor anchorTargetStickyNavbar_Vzrq" id="configure-session-service-type">Configure Session Service Type<a href="#configure-session-service-type" class="hash-link" aria-label="Direct link to Configure Session Service Type" title="Direct link to Configure Session Service Type" translate="no"></a></h4>
+<p>User credentials are stored in the same database configured for session storage. For details on configuring session storage, see the <a class="" href="/solace-agent-mesh/docs/documentation/installing-and-configuring/session-storage">Session Storage documentation</a>.</p>
+<p>Memory storage does not persist credentials across agent restarts. Use this only for development and testing.</p>
+<p><strong>Important</strong>: Ensure each agent has its own database to maintain proper credential isolation between agents.</p>
+<h3 class="anchor anchorTargetStickyNavbar_Vzrq" id="step-2-configure-trust-manager-recommended">Step 2: Configure Trust Manager (Recommended)<a href="#step-2-configure-trust-manager-recommended" class="hash-link" aria-label="Direct link to Step 2: Configure Trust Manager (Recommended)" title="Direct link to Step 2: Configure Trust Manager (Recommended)" translate="no"></a></h3>
+<p>The trust manager provides critical security for Secure User Delegated Access by cryptographically verifying user identities throughout the system. It ensures that credentials can only be accessed by the user who created them, preventing unauthorized access even if agent communication is compromised.</p>
+<p><strong>Enabling the trust manager is strongly recommended for production deployments.</strong></p>
+<h4 class="anchor anchorTargetStickyNavbar_Vzrq" id="understanding-trust-manager">Understanding Trust Manager<a href="#understanding-trust-manager" class="hash-link" aria-label="Direct link to Understanding Trust Manager" title="Direct link to Understanding Trust Manager" translate="no"></a></h4>
+<p>The trust manager uses public/private key cryptography to verify user identity:</p>
+<ol>
+<li class=""><strong>Gateway Authentication</strong>: The WebUI Gateway verifies the user&#x27;s identity during login (via SSO or other authentication)</li>
+<li class=""><strong>Cryptographic Signing</strong>: The gateway cryptographically signs each user&#x27;s identity using its private key</li>
+<li class=""><strong>Agent Verification</strong>: When an agent receives a request, it uses the gateway&#x27;s public key to verify the signed identity</li>
+<li class=""><strong>Credential Access Control</strong>: The agent only grants access to credentials if the verified identity matches the credential owner</li>
+</ol>
+<p>This cryptographic verification ensures that:</p>
+<ul>
+<li class="">User identities cannot be forged or tampered with in transit</li>
+<li class="">Each user can only access their own credentials</li>
+<li class="">Compromised agents cannot access other users&#x27; credentials</li>
+<li class="">All credential operations have verifiable audit trails</li>
+</ul>
+<p><strong>The trust manager must be enabled on both the WebUI Gateway and all agents</strong> to function correctly.</p>
+<h4 class="anchor anchorTargetStickyNavbar_Vzrq" id="enable-trust-manager-on-sse-gateway">Enable Trust Manager on SSE Gateway<a href="#enable-trust-manager-on-sse-gateway" class="hash-link" aria-label="Direct link to Enable Trust Manager on SSE Gateway" title="Direct link to Enable Trust Manager on SSE Gateway" translate="no"></a></h4>
+<p>Add the trust manager configuration to your SSE Gateway configuration:</p>
+<div class="language-yaml codeBlockContainer_Ckt0 theme-code-block" style="--prism-color:#F8F8F2;--prism-background-color:#282A36"><div class="codeBlockContent_QJqH"><pre tabindex="0" class="prism-code language-yaml codeBlock_bY9V thin-scrollbar" style="color:#F8F8F2;background-color:#282A36"><code class="codeBlockLines_e6Vv"><span class="token-line" style="color:#F8F8F2"><span class="token comment" style="color:rgb(98, 114, 164)"># In your gateway configuration</span><span class="token plain"></span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain"></span><span class="token key atrule">trust_manager</span><span class="token punctuation" style="color:rgb(248, 248, 242)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain">  </span><span class="token key atrule">enabled</span><span class="token punctuation" style="color:rgb(248, 248, 242)">:</span><span class="token plain"> </span><span class="token boolean important">true</span><br></span></code></pre></div></div>
+<h4 class="anchor anchorTargetStickyNavbar_Vzrq" id="enable-trust-manager-on-agents">Enable Trust Manager on Agents<a href="#enable-trust-manager-on-agents" class="hash-link" aria-label="Direct link to Enable Trust Manager on Agents" title="Direct link to Enable Trust Manager on Agents" translate="no"></a></h4>
+<p>Add the same trust manager configuration to each agent&#x27;s configuration:</p>
+<div class="language-yaml codeBlockContainer_Ckt0 theme-code-block" style="--prism-color:#F8F8F2;--prism-background-color:#282A36"><div class="codeBlockContent_QJqH"><pre tabindex="0" class="prism-code language-yaml codeBlock_bY9V thin-scrollbar" style="color:#F8F8F2;background-color:#282A36"><code class="codeBlockLines_e6Vv"><span class="token-line" style="color:#F8F8F2"><span class="token comment" style="color:rgb(98, 114, 164)"># In each agent&#x27;s configuration YAML</span><span class="token plain"></span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain"></span><span class="token key atrule">trust_manager</span><span class="token punctuation" style="color:rgb(248, 248, 242)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain">  </span><span class="token key atrule">enabled</span><span class="token punctuation" style="color:rgb(248, 248, 242)">:</span><span class="token plain"> </span><span class="token boolean important">true</span><br></span></code></pre></div></div>
+<h4 class="anchor anchorTargetStickyNavbar_Vzrq" id="example-configuration">Example Configuration<a href="#example-configuration" class="hash-link" aria-label="Direct link to Example Configuration" title="Direct link to Example Configuration" translate="no"></a></h4>
+<p>Here is an example showing the trust manager full configuration (default values) on the gateway:</p>
+<div class="language-yaml codeBlockContainer_Ckt0 theme-code-block" style="--prism-color:#F8F8F2;--prism-background-color:#282A36"><div class="codeBlockContent_QJqH"><pre tabindex="0" class="prism-code language-yaml codeBlock_bY9V thin-scrollbar" style="color:#F8F8F2;background-color:#282A36"><code class="codeBlockLines_e6Vv"><span class="token-line" style="color:#F8F8F2"><span class="token comment" style="color:rgb(98, 114, 164)"># webui_gateway.yaml</span><span class="token plain"></span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain"></span><span class="token key atrule">apps</span><span class="token punctuation" style="color:rgb(248, 248, 242)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain">  </span><span class="token punctuation" style="color:rgb(248, 248, 242)">-</span><span class="token plain"> </span><span class="token key atrule">name</span><span class="token punctuation" style="color:rgb(248, 248, 242)">:</span><span class="token plain"> a2a_webui_app</span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain">    </span><span class="token key atrule">app_config</span><span class="token punctuation" style="color:rgb(248, 248, 242)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain">      </span><span class="token comment" style="color:rgb(98, 114, 164)"># ... other configuration ...</span><span class="token plain"></span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain" style="display:inline-block"></span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain">      </span><span class="token key atrule">trust_manager</span><span class="token punctuation" style="color:rgb(248, 248, 242)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain">        </span><span class="token key atrule">enabled</span><span class="token punctuation" style="color:rgb(248, 248, 242)">:</span><span class="token plain"> </span><span class="token boolean important">true</span><span class="token plain"></span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain">        </span><span class="token key atrule">card_publish_interval_seconds</span><span class="token punctuation" style="color:rgb(248, 248, 242)">:</span><span class="token plain"> </span><span class="token number">10</span><span class="token plain"></span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain">        </span><span class="token key atrule">card_expiration_days</span><span class="token punctuation" style="color:rgb(248, 248, 242)">:</span><span class="token plain"> </span><span class="token number">7</span><span class="token plain"></span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain">        </span><span class="token key atrule">verification_mode</span><span class="token punctuation" style="color:rgb(248, 248, 242)">:</span><span class="token plain"> </span><span class="token string" style="color:rgb(255, 121, 198)">&quot;permissive&quot;</span><span class="token plain">  </span><span class="token comment" style="color:rgb(98, 114, 164)"># or &quot;strict&quot; for production</span><span class="token plain"></span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain">        </span><span class="token key atrule">clock_skew_tolerance_seconds</span><span class="token punctuation" style="color:rgb(248, 248, 242)">:</span><span class="token plain"> </span><span class="token number">300</span><span class="token plain"></span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain">        </span><span class="token key atrule">enable_time_validation</span><span class="token punctuation" style="color:rgb(248, 248, 242)">:</span><span class="token plain"> </span><span class="token boolean important">true</span><span class="token plain"></span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain">        </span><span class="token key atrule">jwt_default_ttl_seconds</span><span class="token punctuation" style="color:rgb(248, 248, 242)">:</span><span class="token plain"> </span><span class="token number">3600</span><span class="token plain"></span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain">        </span><span class="token key atrule">jwt_max_ttl_seconds</span><span class="token punctuation" style="color:rgb(248, 248, 242)">:</span><span class="token plain"> </span><span class="token number">86400</span><br></span></code></pre></div></div>
+<h4 class="anchor anchorTargetStickyNavbar_Vzrq" id="secure-solace-broker-provisioning-for-trust-manager">Secure Solace Broker Provisioning for Trust Manager<a href="#secure-solace-broker-provisioning-for-trust-manager" class="hash-link" aria-label="Direct link to Secure Solace Broker Provisioning for Trust Manager" title="Direct link to Secure Solace Broker Provisioning for Trust Manager" translate="no"></a></h4>
+<p>When using the trust manager, you should configure the Solace broker with proper credentials and ACLs to ensure secure trust card publishing. This prevents components from impersonating each other.</p>
+<p><strong>Distinct Credentials Per Component</strong></p>
+<p>Each gateway and agent instance should have its own unique broker credentials:</p>
+<ul>
+<li class="">Each gateway instance requires unique <code>client_username</code> and <code>client_password</code></li>
+<li class="">Each agent instance requires unique <code>client_username</code> and <code>client_password</code></li>
+<li class="">Never share credentials between different component instances</li>
+</ul>
+<p><strong>ACL Configuration for Trust Card Publishing</strong></p>
+<p>Configure Access Control Lists (ACLs) on your Solace broker to restrict which topics each component can publish to:</p>
+<p><strong>For Gateway instances:</strong></p>
+<p>Only the specific gateway instance is allowed to publish on its trust card topic:</p>
+<div class="language-text codeBlockContainer_Ckt0 theme-code-block" style="--prism-color:#F8F8F2;--prism-background-color:#282A36"><div class="codeBlockContent_QJqH"><pre tabindex="0" class="prism-code language-text codeBlock_bY9V thin-scrollbar" style="color:#F8F8F2;background-color:#282A36"><code class="codeBlockLines_e6Vv"><span class="token-line" style="color:#F8F8F2"><span class="token plain">Topic: {namespace}/a2a/v1/trust/gateway/{gateway_broker_client_username}</span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain">Permission: Publish (allow only for this gateway&#x27;s client username)</span><br></span></code></pre></div></div>
+<p><strong>For Agent instances:</strong></p>
+<p>Only the specific agent instance is allowed to publish on its trust card topic:</p>
+<div class="language-text codeBlockContainer_Ckt0 theme-code-block" style="--prism-color:#F8F8F2;--prism-background-color:#282A36"><div class="codeBlockContent_QJqH"><pre tabindex="0" class="prism-code language-text codeBlock_bY9V thin-scrollbar" style="color:#F8F8F2;background-color:#282A36"><code class="codeBlockLines_e6Vv"><span class="token-line" style="color:#F8F8F2"><span class="token plain">Topic: {namespace}/a2a/v1/trust/agent/{agent_broker_client_username}</span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain">Permission: Publish (allow only for this agent&#x27;s client username)</span><br></span></code></pre></div></div>
+<p>Where:</p>
+<ul>
+<li class=""><code>{namespace}</code> is your configured namespace (e.g., <code>a2a/dev</code> or <code>a2a/prod</code>)</li>
+<li class=""><code>{gateway_broker_client_username}</code> is the unique broker username for the gateway</li>
+<li class=""><code>{agent_broker_client_username}</code> is the unique broker username for each agent</li>
+</ul>
+<p><strong>Example ACL Configuration:</strong></p>
+<p>If your namespace is <code>a2a/prod</code>, gateway username is <code>webui-gateway-01</code>, and agent username is <code>employee-agent-01</code>:</p>
+<div class="language-text codeBlockContainer_Ckt0 theme-code-block" style="--prism-color:#F8F8F2;--prism-background-color:#282A36"><div class="codeBlockContent_QJqH"><pre tabindex="0" class="prism-code language-text codeBlock_bY9V thin-scrollbar" style="color:#F8F8F2;background-color:#282A36"><code class="codeBlockLines_e6Vv"><span class="token-line" style="color:#F8F8F2"><span class="token plain"># Gateway ACL</span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain">Topic: a2a/prod/a2a/v1/trust/gateway/webui-gateway-01</span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain">Client Username: webui-gateway-01</span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain">Permission: Publish</span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain" style="display:inline-block"></span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain"># Agent ACL</span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain">Topic: a2a/prod/a2a/v1/trust/agent/employee-agent-01</span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain">Client Username: employee-agent-01</span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain">Permission: Publish</span><br></span></code></pre></div></div>
+<p>These ACLs ensure that:</p>
+<ul>
+<li class="">Components cannot publish trust cards pretending to be other components</li>
+<li class="">Trust card verification remains cryptographically secure</li>
+<li class="">Compromised credentials for one component cannot affect other components</li>
+</ul>
+<h3 class="anchor anchorTargetStickyNavbar_Vzrq" id="step-3-configure-mcp-tools-with-oauth2-authentication">Step 3: Configure MCP Tools with OAuth2 Authentication<a href="#step-3-configure-mcp-tools-with-oauth2-authentication" class="hash-link" aria-label="Direct link to Step 3: Configure MCP Tools with OAuth2 Authentication" title="Direct link to Step 3: Configure MCP Tools with OAuth2 Authentication" translate="no"></a></h3>
+<p>To use Secure User Delegated Access, you must configure your MCP tools to use OAuth2 authentication and provide a manifest of available tools.</p>
+<h4 class="anchor anchorTargetStickyNavbar_Vzrq" id="basic-mcp-tool-structure">Basic MCP Tool Structure<a href="#basic-mcp-tool-structure" class="hash-link" aria-label="Direct link to Basic MCP Tool Structure" title="Direct link to Basic MCP Tool Structure" translate="no"></a></h4>
+<p>An MCP tool configuration with OAuth2 authentication follows this structure:</p>
+<div class="language-yaml codeBlockContainer_Ckt0 theme-code-block" style="--prism-color:#F8F8F2;--prism-background-color:#282A36"><div class="codeBlockContent_QJqH"><pre tabindex="0" class="prism-code language-yaml codeBlock_bY9V thin-scrollbar" style="color:#F8F8F2;background-color:#282A36"><code class="codeBlockLines_e6Vv"><span class="token-line" style="color:#F8F8F2"><span class="token key atrule">tools</span><span class="token punctuation" style="color:rgb(248, 248, 242)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain">  </span><span class="token punctuation" style="color:rgb(248, 248, 242)">-</span><span class="token plain"> </span><span class="token key atrule">tool_type</span><span class="token punctuation" style="color:rgb(248, 248, 242)">:</span><span class="token plain"> mcp</span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain">    </span><span class="token key atrule">connection_params</span><span class="token punctuation" style="color:rgb(248, 248, 242)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain">      </span><span class="token key atrule">type</span><span class="token punctuation" style="color:rgb(248, 248, 242)">:</span><span class="token plain"> sse  </span><span class="token comment" style="color:rgb(98, 114, 164)"># or streamable-http</span><span class="token plain"></span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain">      </span><span class="token key atrule">url</span><span class="token punctuation" style="color:rgb(248, 248, 242)">:</span><span class="token plain"> </span><span class="token string" style="color:rgb(255, 121, 198)">&quot;https://mcp.example.com/v1/sse&quot;</span><span class="token plain"></span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain">    </span><span class="token key atrule">auth</span><span class="token punctuation" style="color:rgb(248, 248, 242)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain">      </span><span class="token key atrule">type</span><span class="token punctuation" style="color:rgb(248, 248, 242)">:</span><span class="token plain"> oauth2</span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain">    </span><span class="token key atrule">manifest</span><span class="token punctuation" style="color:rgb(248, 248, 242)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain">      </span><span class="token punctuation" style="color:rgb(248, 248, 242)">-</span><span class="token plain"> </span><span class="token key atrule">name</span><span class="token punctuation" style="color:rgb(248, 248, 242)">:</span><span class="token plain"> exampleTool</span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain">        </span><span class="token key atrule">description</span><span class="token punctuation" style="color:rgb(248, 248, 242)">:</span><span class="token plain"> Example tool description</span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain">        </span><span class="token key atrule">inputSchema</span><span class="token punctuation" style="color:rgb(248, 248, 242)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain">          </span><span class="token key atrule">type</span><span class="token punctuation" style="color:rgb(248, 248, 242)">:</span><span class="token plain"> object</span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain">          </span><span class="token key atrule">properties</span><span class="token punctuation" style="color:rgb(248, 248, 242)">:</span><span class="token plain"> </span><span class="token punctuation" style="color:rgb(248, 248, 242)">{</span><span class="token punctuation" style="color:rgb(248, 248, 242)">}</span><span class="token plain"></span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain">          </span><span class="token key atrule">additionalProperties</span><span class="token punctuation" style="color:rgb(248, 248, 242)">:</span><span class="token plain"> </span><span class="token boolean important">false</span><span class="token plain"></span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain">          </span><span class="token key atrule">$schema</span><span class="token punctuation" style="color:rgb(248, 248, 242)">:</span><span class="token plain"> http</span><span class="token punctuation" style="color:rgb(248, 248, 242)">:</span><span class="token plain">//json</span><span class="token punctuation" style="color:rgb(248, 248, 242)">-</span><span class="token plain">schema.org/draft</span><span class="token punctuation" style="color:rgb(248, 248, 242)">-</span><span class="token plain">07/schema</span><span class="token comment" style="color:rgb(98, 114, 164)">#</span><br></span></code></pre></div></div>
+<p>The key components are:</p>
+<p><strong><code>tool_type: mcp</code></strong>: Identifies this as an MCP tool configuration.</p>
+<p><strong><code>connection_params</code></strong>: Specifies how to connect to the remote MCP server:</p>
+<ul>
+<li class=""><code>type</code>: Either <code>sse</code> (Server-Sent Events) or <code>streamable-http</code></li>
+<li class=""><code>url</code>: The endpoint URL for the MCP server</li>
+</ul>
+<p><strong><code>auth</code></strong>: Specifies the authentication type:</p>
+<ul>
+<li class=""><code>type: oauth2</code>: Enables OAuth2 user delegated access for this tool</li>
+</ul>
+<p><strong><code>manifest</code></strong>: Defines the tools available from this MCP server (explained below).</p>
+<h4 class="anchor anchorTargetStickyNavbar_Vzrq" id="understanding-the-manifest-requirement">Understanding the Manifest Requirement<a href="#understanding-the-manifest-requirement" class="hash-link" aria-label="Direct link to Understanding the Manifest Requirement" title="Direct link to Understanding the Manifest Requirement" translate="no"></a></h4>
+<p>Due to limitations in the MCP protocol, Agent Mesh Enterprise cannot automatically discover available tools from OAuth2-protected MCP servers. The OAuth2 flow requires user interaction, which prevents the automatic tool discovery process from working.</p>
+<p>To work around this limitation, you must provide a manifest that lists the tools available from the MCP server. This manifest is identical to what the MCP server would return from its tools list command.</p>
+<h4 class="anchor anchorTargetStickyNavbar_Vzrq" id="obtaining-the-manifest">Obtaining the Manifest<a href="#obtaining-the-manifest" class="hash-link" aria-label="Direct link to Obtaining the Manifest" title="Direct link to Obtaining the Manifest" translate="no"></a></h4>
+<p>You can obtain the manifest in several ways:</p>
+<p><strong>Method 1: Use MCP Provider Documentation</strong></p>
+<p>Many MCP providers document their available tools. Check the provider&#x27;s documentation for a list of tools and their schemas.</p>
+<p><strong>Method 2: Use MCP Inspector</strong></p>
+<p>Use a tool like <a href="https://github.com/modelcontextprotocol/inspector" target="_blank" rel="noopener noreferrer" class="">MCP Inspector</a> to connect to the MCP server and retrieve the output of the tools list command. You can then use this output directly as your manifest configuration.</p>
+<h4 class="anchor anchorTargetStickyNavbar_Vzrq" id="manifest-format">Manifest Format<a href="#manifest-format" class="hash-link" aria-label="Direct link to Manifest Format" title="Direct link to Manifest Format" translate="no"></a></h4>
+<p>Each tool in the manifest follows this format:</p>
+<div class="language-yaml codeBlockContainer_Ckt0 theme-code-block" style="--prism-color:#F8F8F2;--prism-background-color:#282A36"><div class="codeBlockContent_QJqH"><pre tabindex="0" class="prism-code language-yaml codeBlock_bY9V thin-scrollbar" style="color:#F8F8F2;background-color:#282A36"><code class="codeBlockLines_e6Vv"><span class="token-line" style="color:#F8F8F2"><span class="token punctuation" style="color:rgb(248, 248, 242)">-</span><span class="token plain"> </span><span class="token key atrule">name</span><span class="token punctuation" style="color:rgb(248, 248, 242)">:</span><span class="token plain"> toolName</span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain">  </span><span class="token key atrule">description</span><span class="token punctuation" style="color:rgb(248, 248, 242)">:</span><span class="token plain"> Tool description explaining what it does</span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain">  </span><span class="token key atrule">inputSchema</span><span class="token punctuation" style="color:rgb(248, 248, 242)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain">    </span><span class="token key atrule">type</span><span class="token punctuation" style="color:rgb(248, 248, 242)">:</span><span class="token plain"> object</span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain">    </span><span class="token key atrule">properties</span><span class="token punctuation" style="color:rgb(248, 248, 242)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain">      </span><span class="token key atrule">parameterName</span><span class="token punctuation" style="color:rgb(248, 248, 242)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain">        </span><span class="token key atrule">type</span><span class="token punctuation" style="color:rgb(248, 248, 242)">:</span><span class="token plain"> string</span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain">        </span><span class="token key atrule">description</span><span class="token punctuation" style="color:rgb(248, 248, 242)">:</span><span class="token plain"> Parameter description</span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain">    </span><span class="token key atrule">required</span><span class="token punctuation" style="color:rgb(248, 248, 242)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain">      </span><span class="token punctuation" style="color:rgb(248, 248, 242)">-</span><span class="token plain"> parameterName</span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain">    </span><span class="token key atrule">additionalProperties</span><span class="token punctuation" style="color:rgb(248, 248, 242)">:</span><span class="token plain"> </span><span class="token boolean important">false</span><span class="token plain"></span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain">    </span><span class="token key atrule">$schema</span><span class="token punctuation" style="color:rgb(248, 248, 242)">:</span><span class="token plain"> http</span><span class="token punctuation" style="color:rgb(248, 248, 242)">:</span><span class="token plain">//json</span><span class="token punctuation" style="color:rgb(248, 248, 242)">-</span><span class="token plain">schema.org/draft</span><span class="token punctuation" style="color:rgb(248, 248, 242)">-</span><span class="token plain">07/schema</span><span class="token comment" style="color:rgb(98, 114, 164)">#</span><br></span></code></pre></div></div>
+<p>The <code>inputSchema</code> is a standard JSON Schema (draft-07) that defines what parameters the tool accepts. This schema is used for validation and to help the AI model understand how to call the tool.</p>
+<p><strong>Note</strong>: Complete sample MCP configurations are available in the <a href="https://github.com/SolaceLabs/solace-agent-mesh/tree/main/examples/agents/remote-mcp" target="_blank" rel="noopener noreferrer" class="">examples/agents/remote-mcp directory</a> for each of the tested remote MCP providers (Atlassian, Stripe, Cloudflare, Canva) to simplify setup.</p>
+<h3 class="anchor anchorTargetStickyNavbar_Vzrq" id="step-4-deploy-configuration">Step 4: Deploy Configuration<a href="#step-4-deploy-configuration" class="hash-link" aria-label="Direct link to Step 4: Deploy Configuration" title="Direct link to Step 4: Deploy Configuration" translate="no"></a></h3>
+<p>After configuring credential storage, trust manager, and MCP tools, deploy these configurations to your Agent Mesh Enterprise installation. Ensure that:</p>
+<ul>
+<li class="">Configuration files with MCP tool definitions are accessible to the agents</li>
+<li class="">Environment variables (<code>SECRETS_TTL_SECONDS</code>, <code>OAUTH_TOOL_REDIRECT_URI</code>) are set</li>
+<li class="">Database URLs are configured if using SQL persistence</li>
+<li class="">The installation is restarted to load the new configuration</li>
+</ul>
+<p>After deployment, test the OAuth2 flow by attempting to use an OAuth2-enabled MCP tool. Users should be prompted to authenticate with the MCP provider.</p>
+<h2 class="anchor anchorTargetStickyNavbar_Vzrq" id="security-considerations">Security Considerations<a href="#security-considerations" class="hash-link" aria-label="Direct link to Security Considerations" title="Direct link to Security Considerations" translate="no"></a></h2>
+<p>Secure User Delegated Access involves storing and managing user credentials, which requires careful attention to security. This section outlines the security features built into the system and additional measures you should implement.</p>
+<h3 class="anchor anchorTargetStickyNavbar_Vzrq" id="encryption-at-rest">Encryption at Rest<a href="#encryption-at-rest" class="hash-link" aria-label="Direct link to Encryption at Rest" title="Direct link to Encryption at Rest" translate="no"></a></h3>
+<p>When using SQL persistence, all stored credentials are automatically encrypted before being written to the database. Agent Mesh Enterprise uses the agent&#x27;s unique identifier as the encryption key, ensuring that credentials cannot be used if extracted from storage.</p>
+<p>This encryption is automatic and requires no configuration. However, it means that:</p>
+<ul>
+<li class="">Credentials encrypted by one agent cannot be decrypted by another agent</li>
+<li class="">If an agent&#x27;s unique identifier changes, existing credentials become inaccessible</li>
+<li class="">Database backups contain encrypted credentials that are useless without the agent</li>
+</ul>
+<p>For additional security, ensure your database is stored on encrypted storage volumes provided by your infrastructure (for example, encrypted EBS volumes in AWS, encrypted persistent disks in GCP).</p>
+<p><strong>Note</strong>: Memory-based storage does not persist credentials to disk, so encryption at rest does not apply. Memory storage should only be used for development and testing.</p>
+<h3 class="anchor anchorTargetStickyNavbar_Vzrq" id="trust-manager-for-identity-verification">Trust Manager for Identity Verification<a href="#trust-manager-for-identity-verification" class="hash-link" aria-label="Direct link to Trust Manager for Identity Verification" title="Direct link to Trust Manager for Identity Verification" translate="no"></a></h3>
+<p>The trust manager provides defense-in-depth by verifying user identity on every credential operation. This prevents several attack scenarios:</p>
+<p><strong>Credential Theft via Agent Compromise</strong>: If an attacker compromises an agent and attempts to retrieve another user&#x27;s credentials, the trust manager validates the user&#x27;s identity token and denies access.</p>
+<p><strong>Man-in-the-Middle Attacks</strong>: The trust manager validates that identity tokens are signed by a trusted issuer, preventing token forgery.</p>
+<p><strong>Replay Attacks</strong>: Identity tokens include expiration times, limiting the window for replay attacks.</p>
+<p>To maximize trust manager security:</p>
+<ul>
+<li class="">Always enable trust manager (<code>enabled: true</code>) in production</li>
+<li class="">Monitor trust manager logs for denied access attempts</li>
+</ul>
+<h3 class="anchor anchorTargetStickyNavbar_Vzrq" id="credential-aging-and-expiration">Credential Aging and Expiration<a href="#credential-aging-and-expiration" class="hash-link" aria-label="Direct link to Credential Aging and Expiration" title="Direct link to Credential Aging and Expiration" translate="no"></a></h3>
+<p>The <code>SECRETS_TTL_SECONDS</code> configuration provides defense against long-lived credential compromise. By setting an appropriate TTL, you ensure that:</p>
+<ul>
+<li class="">Stolen credentials have a limited lifetime</li>
+<li class="">Terminated users&#x27; credentials expire automatically</li>
+<li class="">Users periodically re-authenticate, allowing detection of account compromise</li>
+</ul>
+<p>The default TTL is 30 days (2592000 seconds) if not specified.</p>
+<h3 class="anchor anchorTargetStickyNavbar_Vzrq" id="provider-side-revocation">Provider-Side Revocation<a href="#provider-side-revocation" class="hash-link" aria-label="Direct link to Provider-Side Revocation" title="Direct link to Provider-Side Revocation" translate="no"></a></h3>
+<p>MCP providers can revoke user credentials at any time through their own admin consoles. This provides an additional security control:</p>
+<p><strong>User Offboarding</strong>: When a user leaves the organization, revoke their access at the MCP provider level (Atlassian, Stripe, etc.) in addition to removing their access to Agent Mesh Enterprise.</p>
+<p><strong>Incident Response</strong>: If you suspect credential compromise, immediately revoke access at the MCP provider level. This blocks credential use even before they expire in Agent Mesh Enterprise.</p>
+<p><strong>Audit Compliance</strong>: Provider-side revocation creates audit logs in the provider&#x27;s system, which may be required for compliance purposes.</p>
+<p>Document your incident response procedures to include MCP provider credential revocation as a standard step.</p>
+<h3 class="anchor anchorTargetStickyNavbar_Vzrq" id="network-security">Network Security<a href="#network-security" class="hash-link" aria-label="Direct link to Network Security" title="Direct link to Network Security" translate="no"></a></h3>
+<p>Secure User Delegated Access involves network communication between users, Agent Mesh Enterprise, and MCP providers. Implement these network security measures:</p>
+<p><strong>Use HTTPS Everywhere</strong>: All communication must use HTTPS in production:</p>
+<ul>
+<li class="">User to Agent Mesh Enterprise: HTTPS</li>
+<li class="">Agent Mesh Enterprise to MCP providers: HTTPS</li>
+<li class="">MCP provider redirects back to Agent Mesh Enterprise: HTTPS</li>
+</ul>
+<p><strong>Internal Communication Security</strong>: If using the trust manager, ensure communication between agents and the SSE gateway is encrypted and authenticated.</p>
+<h3 class="anchor anchorTargetStickyNavbar_Vzrq" id="logging-and-monitoring">Logging and Monitoring<a href="#logging-and-monitoring" class="hash-link" aria-label="Direct link to Logging and Monitoring" title="Direct link to Logging and Monitoring" translate="no"></a></h3>
+<p>Enable comprehensive logging to detect and respond to security issues.</p>
+<p><strong>Anomalous Patterns</strong>: Monitor for unusual patterns such as:</p>
+<ul>
+<li class="">Multiple failed authentication attempts from a single user</li>
+<li class="">Credential access from unusual IP addresses or locations</li>
+<li class="">Rapid credential creation/deletion cycles</li>
+</ul>
+<p>Integrate these logs with your SIEM (Security Information and Event Management) system for centralized monitoring and alerting.</p>
+<h2 class="anchor anchorTargetStickyNavbar_Vzrq" id="best-practices">Best Practices<a href="#best-practices" class="hash-link" aria-label="Direct link to Best Practices" title="Direct link to Best Practices" translate="no"></a></h2>
+<p>Following these best practices helps you deploy Secure User Delegated Access securely and reliably.</p>
+<h3 class="anchor anchorTargetStickyNavbar_Vzrq" id="always-enable-trust-manager-in-production">Always Enable Trust Manager in Production<a href="#always-enable-trust-manager-in-production" class="hash-link" aria-label="Direct link to Always Enable Trust Manager in Production" title="Direct link to Always Enable Trust Manager in Production" translate="no"></a></h3>
+<p>The trust manager provides critical defense-in-depth security. Always enable it in production deployments:</p>
+<div class="language-yaml codeBlockContainer_Ckt0 theme-code-block" style="--prism-color:#F8F8F2;--prism-background-color:#282A36"><div class="codeBlockContent_QJqH"><pre tabindex="0" class="prism-code language-yaml codeBlock_bY9V thin-scrollbar" style="color:#F8F8F2;background-color:#282A36"><code class="codeBlockLines_e6Vv"><span class="token-line" style="color:#F8F8F2"><span class="token key atrule">trust_manager</span><span class="token punctuation" style="color:rgb(248, 248, 242)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain">  </span><span class="token key atrule">enabled</span><span class="token punctuation" style="color:rgb(248, 248, 242)">:</span><span class="token plain"> </span><span class="token boolean important">true</span><br></span></code></pre></div></div>
+<p>Only disable the trust manager in development or testing environments where security is not a concern.</p>
+<h3 class="anchor anchorTargetStickyNavbar_Vzrq" id="use-sql-persistence-in-production">Use SQL Persistence in Production<a href="#use-sql-persistence-in-production" class="hash-link" aria-label="Direct link to Use SQL Persistence in Production" title="Direct link to Use SQL Persistence in Production" translate="no"></a></h3>
+<p>Memory persistence is only suitable for development and testing. Production deployments must use SQL persistence:</p>
+<div class="language-yaml codeBlockContainer_Ckt0 theme-code-block" style="--prism-color:#F8F8F2;--prism-background-color:#282A36"><div class="codeBlockContent_QJqH"><pre tabindex="0" class="prism-code language-yaml codeBlock_bY9V thin-scrollbar" style="color:#F8F8F2;background-color:#282A36"><code class="codeBlockLines_e6Vv"><span class="token-line" style="color:#F8F8F2"><span class="token key atrule">session_service</span><span class="token punctuation" style="color:rgb(248, 248, 242)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain">  </span><span class="token key atrule">type</span><span class="token punctuation" style="color:rgb(248, 248, 242)">:</span><span class="token plain"> </span><span class="token string" style="color:rgb(255, 121, 198)">&quot;sql&quot;</span><span class="token plain"></span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain">  </span><span class="token key atrule">database_url</span><span class="token punctuation" style="color:rgb(248, 248, 242)">:</span><span class="token plain"> $</span><span class="token punctuation" style="color:rgb(248, 248, 242)">{</span><span class="token plain">AGENT_DATABASE_URL</span><span class="token punctuation" style="color:rgb(248, 248, 242)">}</span><span class="token plain"></span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain">  </span><span class="token key atrule">default_behavior</span><span class="token punctuation" style="color:rgb(248, 248, 242)">:</span><span class="token plain"> </span><span class="token string" style="color:rgb(255, 121, 198)">&quot;PERSISTENT&quot;</span><br></span></code></pre></div></div>
+<h3 class="anchor anchorTargetStickyNavbar_Vzrq" id="set-appropriate-ttl-values">Set Appropriate TTL Values<a href="#set-appropriate-ttl-values" class="hash-link" aria-label="Direct link to Set Appropriate TTL Values" title="Direct link to Set Appropriate TTL Values" translate="no"></a></h3>
+<p>Choose TTL values based on your security requirements and user experience considerations.</p>
+<p>Never exceed 30 days (2592000 seconds). Document your TTL policy and rationale in your security documentation.</p>
+<h3 class="anchor anchorTargetStickyNavbar_Vzrq" id="configure-separate-session-storage-per-agent">Configure Separate Session Storage Per Agent<a href="#configure-separate-session-storage-per-agent" class="hash-link" aria-label="Direct link to Configure Separate Session Storage Per Agent" title="Direct link to Configure Separate Session Storage Per Agent" translate="no"></a></h3>
+<p>Each agent should have its own session storage database, which will automatically be used for credential storage as well.</p>
+<p>This isolation provides defense-in-depth and simplifies multi-tenant deployments. See the <a class="" href="/solace-agent-mesh/docs/documentation/installing-and-configuring/session-storage">Session Storage documentation</a> for more details on configuring session storage.</p>
+<h3 class="anchor anchorTargetStickyNavbar_Vzrq" id="use-https-in-production">Use HTTPS in Production<a href="#use-https-in-production" class="hash-link" aria-label="Direct link to Use HTTPS in Production" title="Direct link to Use HTTPS in Production" translate="no"></a></h3>
+<p>Configure HTTPS for all endpoints in production:</p>
+<ul>
+<li class="">Set <code>OAUTH_TOOL_REDIRECT_URI</code> to an HTTPS URL</li>
+<li class="">Configure SSL certificates for Agent Mesh Enterprise</li>
+<li class="">Verify that MCP providers use HTTPS endpoints</li>
+<li class="">Never use HTTP in production (only acceptable for local development)</li>
+</ul>
+<h2 class="anchor anchorTargetStickyNavbar_Vzrq" id="troubleshooting">Troubleshooting<a href="#troubleshooting" class="hash-link" aria-label="Direct link to Troubleshooting" title="Direct link to Troubleshooting" translate="no"></a></h2>
+<p>This section addresses common issues you may encounter when configuring or operating Secure User Delegated Access.</p>
+<h3 class="anchor anchorTargetStickyNavbar_Vzrq" id="oauth2-authentication-flow-fails">OAuth2 Authentication Flow Fails<a href="#oauth2-authentication-flow-fails" class="hash-link" aria-label="Direct link to OAuth2 Authentication Flow Fails" title="Direct link to OAuth2 Authentication Flow Fails" translate="no"></a></h3>
+<p><strong>Symptoms</strong>: Users report that they are redirected to the MCP provider but never redirected back to Agent Mesh Enterprise, or they see an error after attempting to authenticate.</p>
+<p><strong>Possible Causes and Solutions</strong>:</p>
+<ol>
+<li class="">
+<p><strong>Incorrect Callback URI</strong>:</p>
+<ul>
+<li class=""><strong>Verify</strong>: Check that <code>OAUTH_TOOL_REDIRECT_URI</code> exactly matches the redirect URI registered with the MCP provider.</li>
+<li class=""><strong>Common mistake</strong>: Mismatched protocols (HTTP vs HTTPS), missing ports, trailing slashes.</li>
+<li class=""><strong>Solution</strong>: Update either the environment variable or the MCP provider configuration to match exactly.</li>
+</ul>
+</li>
+<li class="">
+<p><strong>Domain Not Authorized</strong> (For providers requiring domain authorization):</p>
+<ul>
+<li class=""><strong>Verify</strong>: Check that your domain is listed in the MCP provider&#x27;s authorized domains for MCP access.</li>
+<li class=""><strong>Solution</strong>: Add your domain to the provider&#x27;s authorized domain list following their documentation.</li>
+</ul>
+</li>
+</ol>
+<h3 class="anchor anchorTargetStickyNavbar_Vzrq" id="credentials-not-persisting-across-restarts">Credentials Not Persisting Across Restarts<a href="#credentials-not-persisting-across-restarts" class="hash-link" aria-label="Direct link to Credentials Not Persisting Across Restarts" title="Direct link to Credentials Not Persisting Across Restarts" translate="no"></a></h3>
+<p><strong>Symptoms</strong>: Users must re-authenticate every time the agent restarts, even though SQL persistence is configured.</p>
+<p><strong>Possible Causes and Solutions</strong>:</p>
+<ol>
+<li class=""><strong>Memory Storage Configured Instead of SQL</strong>:<!-- -->
+<ul>
+<li class=""><strong>Verify</strong>: Check the agent configuration to ensure <code>session_service.type</code> is set to <code>&quot;sql&quot;</code>, not <code>&quot;memory&quot;</code>.</li>
+<li class=""><strong>Solution</strong>: Update the configuration and restart the agent.</li>
+</ul>
+</li>
+</ol>
+<h3 class="anchor anchorTargetStickyNavbar_Vzrq" id="trust-manager-denying-access">Trust Manager Denying Access<a href="#trust-manager-denying-access" class="hash-link" aria-label="Direct link to Trust Manager Denying Access" title="Direct link to Trust Manager Denying Access" translate="no"></a></h3>
+<p><strong>Symptoms</strong>: Users receive &quot;Access Denied&quot; errors when attempting to use MCP tools, or logs show trust manager access denials.</p>
+<p><strong>Possible Causes and Solutions</strong>:</p>
+<ol>
+<li class=""><strong>Trust Manager Not Configured on All Components</strong>:<!-- -->
+<ul>
+<li class=""><strong>Verify</strong>: Ensure trust manager is enabled on both the SSE Gateway and all agents.</li>
+<li class=""><strong>Solution</strong>: Add trust manager configuration to all component configurations and restart.</li>
+</ul>
+</li>
+</ol>
+<h3 class="anchor anchorTargetStickyNavbar_Vzrq" id="credentials-expire-too-quickly-or-too-slowly">Credentials Expire Too Quickly or Too Slowly<a href="#credentials-expire-too-quickly-or-too-slowly" class="hash-link" aria-label="Direct link to Credentials Expire Too Quickly or Too Slowly" title="Direct link to Credentials Expire Too Quickly or Too Slowly" translate="no"></a></h3>
+<p><strong>Symptoms</strong>: Users report that they need to re-authenticate too frequently, or credentials remain valid longer than expected.</p>
+<p><strong>Possible Causes and Solutions</strong>:</p>
+<ol>
+<li class="">
+<p><strong>TTL Not Set Correctly</strong>:</p>
+<ul>
+<li class=""><strong>Verify</strong>: Check the <code>SECRETS_TTL_SECONDS</code> environment variable value.</li>
+<li class=""><strong>Solution</strong>: Update the environment variable to the desired TTL and restart the agent.</li>
+</ul>
+</li>
+<li class="">
+<p><strong>MCP Provider Token Expiration</strong>:</p>
+<ul>
+<li class=""><strong>Note</strong>: Even if your TTL is long, MCP providers may issue short-lived tokens.</li>
+<li class=""><strong>Verify</strong>: Check the MCP provider&#x27;s token expiration policy.</li>
+<li class=""><strong>Solution</strong>: This is controlled by the MCP provider and cannot be changed. Ensure refresh tokens are working correctly to automatically renew expired tokens.</li>
+</ul>
+</li>
+<li class="">
+<p><strong>Refresh Tokens Not Working</strong>:</p>
+<ul>
+<li class=""><strong>Verify</strong>: Check that the MCP provider issues refresh tokens and that Agent Mesh Enterprise is configured to use them.</li>
+<li class=""><strong>Diagnostic</strong>: Look for token refresh attempts in the logs.</li>
+<li class=""><strong>Solution</strong>: Ensure the OAuth2 scope includes <code>offline_access</code> or equivalent for the provider.</li>
+</ul>
+</li>
+</ol>
+<h3 class="anchor anchorTargetStickyNavbar_Vzrq" id="manifest-configuration-errors">Manifest Configuration Errors<a href="#manifest-configuration-errors" class="hash-link" aria-label="Direct link to Manifest Configuration Errors" title="Direct link to Manifest Configuration Errors" translate="no"></a></h3>
+<p><strong>Symptoms</strong>: MCP tools are not available, or the AI model reports that tools are missing or incorrectly defined.</p>
+<p><strong>Possible Causes and Solutions</strong>:</p>
+<ol>
+<li class="">
+<p><strong>Manifest Missing or Empty</strong>:</p>
+<ul>
+<li class=""><strong>Verify</strong>: Check that the <code>manifest</code> section in your MCP tool configuration is populated.</li>
+<li class=""><strong>Solution</strong>: Add the manifest with tool definitions as described in the Configuration Steps section.</li>
+</ul>
+</li>
+<li class="">
+<p><strong>Manifest Format Errors</strong>:</p>
+<ul>
+<li class=""><strong>Verify</strong>: Ensure the manifest follows the correct YAML structure and JSON Schema format.</li>
+<li class=""><strong>Common mistakes</strong>: Missing required fields (<code>name</code>, <code>description</code>, <code>inputSchema</code>), invalid JSON Schema.</li>
+<li class=""><strong>Solution</strong>: Validate your manifest structure against the examples in this document.</li>
+</ul>
+</li>
+<li class="">
+<p><strong>JSON Schema Version Issues</strong>:</p>
+<ul>
+<li class=""><strong>Note</strong>: Manifests typically use the <code>http://json-schema.org/draft-07/schema#</code> standard. However, some LLM providers may require the newer <code>https://json-schema.org/specification-links#2020-12</code> specification, which can lead to errors at inference time.</li>
+<li class=""><strong>Solution</strong>: Check your LLM provider&#x27;s requirements and adjust the <code>$schema</code> field in your manifest accordingly.</li>
+</ul>
+</li>
+</ol>
+<p>If you encounter issues, check the latest Agent Mesh Enterprise documentation or enable debug logging to review detailed error information:</p>
+<div class="language-yaml codeBlockContainer_Ckt0 theme-code-block" style="--prism-color:#F8F8F2;--prism-background-color:#282A36"><div class="codeBlockContent_QJqH"><pre tabindex="0" class="prism-code language-yaml codeBlock_bY9V thin-scrollbar" style="color:#F8F8F2;background-color:#282A36"><code class="codeBlockLines_e6Vv"><span class="token-line" style="color:#F8F8F2"><span class="token key atrule">log</span><span class="token punctuation" style="color:rgb(248, 248, 242)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain">  </span><span class="token key atrule">stdout_log_level</span><span class="token punctuation" style="color:rgb(248, 248, 242)">:</span><span class="token plain"> DEBUG</span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain">  </span><span class="token key atrule">log_file_level</span><span class="token punctuation" style="color:rgb(248, 248, 242)">:</span><span class="token plain"> DEBUG</span><br></span></code></pre></div></div>
+<h2 class="anchor anchorTargetStickyNavbar_Vzrq" id="conclusion">Conclusion<a href="#conclusion" class="hash-link" aria-label="Direct link to Conclusion" title="Direct link to Conclusion" translate="no"></a></h2>
+<p>Secure User Delegated Access provides enhanced security and user-specific access control for Agent Mesh Enterprise deployments using remote MCP tools. By following the configuration steps, security considerations, and best practices in this guide, you can deploy this feature securely and reliably.</p>
+<p>Key takeaways:</p>
+<ul>
+<li class="">Always enable the trust manager in production for defense-in-depth security</li>
+<li class="">Use SQL persistence to ensure credentials survive agent restarts</li>
+<li class="">Set appropriate TTL values balancing security and user experience</li>
+<li class="">Configure database-per-agent isolation for multi-tenant security</li>
+<li class="">Follow provider-specific setup instructions carefully</li>
+<li class="">Implement comprehensive monitoring and logging</li>
+<li class="">Maintain regular security reviews of your configuration</li>
+</ul>
+<p>Remember to keep your configuration updated as MCP providers evolve their APIs and authentication requirements, and regularly review your security posture to ensure continued protection of user credentials.</p></div><footer class="theme-doc-footer docusaurus-mt-lg"><div class="row margin-top--sm theme-doc-footer-edit-meta-row"><div class="col noPrint_WFHX"><a href="https://github.com/SolaceLabs/solace-agent-mesh/edit/main/docs/docs/documentation/enterprise/secure-user-delegated-access.md" target="_blank" rel="noopener noreferrer" class="theme-edit-this-page"><svg fill="currentColor" height="20" width="20" viewBox="0 0 40 40" class="iconEdit_Z9Sw" aria-hidden="true"><g><path d="m34.5 11.7l-3 3.1-6.3-6.3 3.1-3q0.5-0.5 1.2-0.5t1.1 0.5l3.9 3.9q0.5 0.4 0.5 1.1t-0.5 1.2z m-29.5 17.1l18.4-18.5 6.3 6.3-18.4 18.4h-6.3v-6.2z"></path></g></svg>Edit this page</a></div><div class="col lastUpdated_JAkA"></div></div></footer></article><nav class="docusaurus-mt-lg pagination-nav" aria-label="Docs pages"><a class="pagination-nav__link pagination-nav__link--prev" href="/solace-agent-mesh/docs/documentation/enterprise/single-sign-on"><div class="pagination-nav__sublabel">Previous</div><div class="pagination-nav__label">Enabling SSO</div></a><a class="pagination-nav__link pagination-nav__link--next" href="/solace-agent-mesh/docs/documentation/enterprise/openapi-tools"><div class="pagination-nav__sublabel">Next</div><div class="pagination-nav__label">OpenAPI Tools</div></a></nav></div></div><div class="col col--3"><div class="tableOfContents_bqdL thin-scrollbar theme-doc-toc-desktop"><ul class="table-of-contents table-of-contents__left-border"><li><a href="#table-of-contents" class="table-of-contents__link toc-highlight">Table of Contents</a></li><li><a href="#overview" class="table-of-contents__link toc-highlight">Overview</a><ul><li><a href="#why-use-secure-user-delegated-access" class="table-of-contents__link toc-highlight">Why Use Secure User Delegated Access</a></li><li><a href="#supported-mcp-providers" class="table-of-contents__link toc-highlight">Supported MCP Providers</a></li></ul></li><li><a href="#understanding-secure-user-delegated-access" class="table-of-contents__link toc-highlight">Understanding Secure User Delegated Access</a><ul><li><a href="#how-the-oauth2-flow-works" class="table-of-contents__link toc-highlight">How the OAuth2 Flow Works</a></li><li><a href="#credential-storage" class="table-of-contents__link toc-highlight">Credential Storage</a></li><li><a href="#credential-lifecycle" class="table-of-contents__link toc-highlight">Credential Lifecycle</a></li></ul></li><li><a href="#prerequisites" class="table-of-contents__link toc-highlight">Prerequisites</a><ul><li><a href="#mcp-provider-access" class="table-of-contents__link toc-highlight">MCP Provider Access</a></li><li><a href="#callback-uri-configuration" class="table-of-contents__link toc-highlight">Callback URI Configuration</a></li><li><a href="#database-setup-for-production" class="table-of-contents__link toc-highlight">Database Setup (For Production)</a></li></ul></li><li><a href="#configuration-steps" class="table-of-contents__link toc-highlight">Configuration Steps</a><ul><li><a href="#step-1-configure-credential-storage-and-lifecycle" class="table-of-contents__link toc-highlight">Step 1: Configure Credential Storage and Lifecycle</a></li><li><a href="#step-2-configure-trust-manager-recommended" class="table-of-contents__link toc-highlight">Step 2: Configure Trust Manager (Recommended)</a></li><li><a href="#step-3-configure-mcp-tools-with-oauth2-authentication" class="table-of-contents__link toc-highlight">Step 3: Configure MCP Tools with OAuth2 Authentication</a></li><li><a href="#step-4-deploy-configuration" class="table-of-contents__link toc-highlight">Step 4: Deploy Configuration</a></li></ul></li><li><a href="#security-considerations" class="table-of-contents__link toc-highlight">Security Considerations</a><ul><li><a href="#encryption-at-rest" class="table-of-contents__link toc-highlight">Encryption at Rest</a></li><li><a href="#trust-manager-for-identity-verification" class="table-of-contents__link toc-highlight">Trust Manager for Identity Verification</a></li><li><a href="#credential-aging-and-expiration" class="table-of-contents__link toc-highlight">Credential Aging and Expiration</a></li><li><a href="#provider-side-revocation" class="table-of-contents__link toc-highlight">Provider-Side Revocation</a></li><li><a href="#network-security" class="table-of-contents__link toc-highlight">Network Security</a></li><li><a href="#logging-and-monitoring" class="table-of-contents__link toc-highlight">Logging and Monitoring</a></li></ul></li><li><a href="#best-practices" class="table-of-contents__link toc-highlight">Best Practices</a><ul><li><a href="#always-enable-trust-manager-in-production" class="table-of-contents__link toc-highlight">Always Enable Trust Manager in Production</a></li><li><a href="#use-sql-persistence-in-production" class="table-of-contents__link toc-highlight">Use SQL Persistence in Production</a></li><li><a href="#set-appropriate-ttl-values" class="table-of-contents__link toc-highlight">Set Appropriate TTL Values</a></li><li><a href="#configure-separate-session-storage-per-agent" class="table-of-contents__link toc-highlight">Configure Separate Session Storage Per Agent</a></li><li><a href="#use-https-in-production" class="table-of-contents__link toc-highlight">Use HTTPS in Production</a></li></ul></li><li><a href="#troubleshooting" class="table-of-contents__link toc-highlight">Troubleshooting</a><ul><li><a href="#oauth2-authentication-flow-fails" class="table-of-contents__link toc-highlight">OAuth2 Authentication Flow Fails</a></li><li><a href="#credentials-not-persisting-across-restarts" class="table-of-contents__link toc-highlight">Credentials Not Persisting Across Restarts</a></li><li><a href="#trust-manager-denying-access" class="table-of-contents__link toc-highlight">Trust Manager Denying Access</a></li><li><a href="#credentials-expire-too-quickly-or-too-slowly" class="table-of-contents__link toc-highlight">Credentials Expire Too Quickly or Too Slowly</a></li><li><a href="#manifest-configuration-errors" class="table-of-contents__link toc-highlight">Manifest Configuration Errors</a></li></ul></li><li><a href="#conclusion" class="table-of-contents__link toc-highlight">Conclusion</a></li></ul></div></div></div></div></main></div></div></div><footer class="theme-layout-footer footer footer--dark"><div class="container container-fluid"><div class="row footer__links"><div class="theme-layout-footer-column col footer__col"><div class="footer__title">Solace Agent Mesh</div><ul class="footer__items clean-list"><li class="footer__item"><a class="footer__link-item" href="/solace-agent-mesh/docs/documentation/getting-started">Documentation</a></li><li class="footer__item"><a href="https://github.com/SolaceLabs/solace-agent-mesh/" target="_blank" rel="noopener noreferrer" class="footer__link-item">GitHub<svg width="13.5" height="13.5" aria-label="(opens in new tab)" class="iconExternalLink_nPIU"><use href="#theme-svg-external-link"></use></svg></a></li><li class="footer__item"><a href="https://github.com/SolaceLabs/solace-agent-mesh-core-plugins/" target="_blank" rel="noopener noreferrer" class="footer__link-item">Official Plugins<svg width="13.5" height="13.5" aria-label="(opens in new tab)" class="iconExternalLink_nPIU"><use href="#theme-svg-external-link"></use></svg></a></li></ul></div><div class="theme-layout-footer-column col footer__col"><div class="footer__title">Company</div><ul class="footer__items clean-list"><li class="footer__item"><a href="https://solace.com/products/" target="_blank" rel="noopener noreferrer" class="footer__link-item">Products<svg width="13.5" height="13.5" aria-label="(opens in new tab)" class="iconExternalLink_nPIU"><use href="#theme-svg-external-link"></use></svg></a></li><li class="footer__item"><a href="https://solace.com/contact/" target="_blank" rel="noopener noreferrer" class="footer__link-item">Contact<svg width="13.5" height="13.5" aria-label="(opens in new tab)" class="iconExternalLink_nPIU"><use href="#theme-svg-external-link"></use></svg></a></li><li class="footer__item"><a href="https://solace.com/support/" target="_blank" rel="noopener noreferrer" class="footer__link-item">Support<svg width="13.5" height="13.5" aria-label="(opens in new tab)" class="iconExternalLink_nPIU"><use href="#theme-svg-external-link"></use></svg></a></li><li class="footer__item"><a href="https://solace.com/legal/" target="_blank" rel="noopener noreferrer" class="footer__link-item">Privacy and Legal<svg width="13.5" height="13.5" aria-label="(opens in new tab)" class="iconExternalLink_nPIU"><use href="#theme-svg-external-link"></use></svg></a></li></ul></div><div class="theme-layout-footer-column col footer__col"><div class="footer__title">Community</div><ul class="footer__items clean-list"><li class="footer__item"><a href="https://www.linkedin.com/company/solacedotcom/" target="_blank" rel="noopener noreferrer" class="footer__link-item">LinkedIn<svg width="13.5" height="13.5" aria-label="(opens in new tab)" class="iconExternalLink_nPIU"><use href="#theme-svg-external-link"></use></svg></a></li><li class="footer__item"><a href="https://github.com/SolaceLabs" target="_blank" rel="noopener noreferrer" class="footer__link-item">GitHub<svg width="13.5" height="13.5" aria-label="(opens in new tab)" class="iconExternalLink_nPIU"><use href="#theme-svg-external-link"></use></svg></a></li><li class="footer__item"><a href="https://www.youtube.com/SolaceSystems" target="_blank" rel="noopener noreferrer" class="footer__link-item">YouTube<svg width="13.5" height="13.5" aria-label="(opens in new tab)" class="iconExternalLink_nPIU"><use href="#theme-svg-external-link"></use></svg></a></li><li class="footer__item"><a href="https://twitter.com/solacedotcom" target="_blank" rel="noopener noreferrer" class="footer__link-item">X<svg width="13.5" height="13.5" aria-label="(opens in new tab)" class="iconExternalLink_nPIU"><use href="#theme-svg-external-link"></use></svg></a></li></ul></div></div><div class="footer__bottom text--center"><div class="margin-bottom--sm"><img src="/solace-agent-mesh/img/solace-logo.png" alt="Solace Logo" class="footer__logo themedComponent_mlkZ themedComponent--light_NVdE" width="10%" height="10%"><img src="/solace-agent-mesh/img/solace-logo.png" alt="Solace Logo" class="footer__logo themedComponent_mlkZ themedComponent--dark_xIcU" width="10%" height="10%"></div><div class="footer__copyright">Solace Agent Mesh. Copyright © 2026 Solace. Version: 1.13.2</div></div></div></footer></div>
+</body>
+</html>