Provision your first agent
This guide describes the lifecycle, which is settled. The commands, screens and payloads depend on the control plane and are not written yet, because documenting an endpoint that does not exist is worse than documenting nothing.
Every unfinished step is marked [pending].
Before you start
- Your identity provider is federated. See Federate your identity provider.
- You have chosen a trust anchor: an existing internal CA, or one Automentic issues.
- You have picked a workflow. Choose one that is repetitive, high volume, and currently painful to evidence — that is where the model earns its keep.
The lifecycle
1. Register the agent
Give it a name and the workflow it serves. [Pending: registration interface.]
2. Choose an identity type
- X.509 where the systems being automated already do certificate authentication, or an internal CA is the trust anchor.
- SPIFFE where the agent runs as a short-lived cloud-native workload.
See Agent identity.
3. Attach a policy
The policy decides what this agent may do, on which systems, under whose authority. Start narrower than you think you need; widening later is a small change, and over-granting is how automation becomes an incident. [Pending: the policy language.]
4. Grant system access
The target system must be configured to accept the agent certificate over mutual TLS. [Pending: per-system setup.]
5. Run it in report-only
Let it evaluate without committing changes, and read the audit trail. You are checking that the actions it would take are the ones you expect. [Pending: whether a report-only mode exists.]
6. Enable, then watch the trail
Move to live and read the audit trail for the first runs. Confirm every action names the right authorising principal.
7. Test revocation
Before you consider it production-ready, revoke the agent while it is working and confirm it stops mid-run. A zero-trust claim you have not tested is a zero-trust claim you do not have.