Identity
Connect your identity provider — dhvati imports its groups as roles and its people as employees.
Keycloak
ConnectedAgent discovery
When an employee connects an AI client (Claude Code, Cursor, a home-grown one) it appears on the Agents page as its own principal: its calls are attributed to it, and you can suspend that one client without touching the employee.
What the client name is, and isn't.The name and version come from what the client says about itself when it connects. Any client can claim to be "Claude Code", and nothing checks it — it is a label, not proof. The employee's IdP sign-in is what authenticates every call, and a discovered client can never exceed that employee's own permissions. (An attested agent is different: its runtime signs a token dhvati verifies cryptographically.)
Off (default).A newly seen client is auto-approved and inherits the employee's own permissions — nobody gains or loses access, you simply gain inventory, attribution and a per-client kill switch.
Changing this is an admin action.