> For the complete documentation index, see [llms.txt](https://docs.apono.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.apono.io/docs/agent-privilege-guard/apono-agent-privilege-guard.md).

# Apono Agent Privilege Guard

**Apono Agent Privilege Guard** provides secure agentic access through the same just-in-time, least-privilege model used to govern human access. It helps organizations extend zero standing privileges to agentic workflows by applying several layers of control:

* **Just-in-time access**: Agents request time-bound access instead of relying on standing permissions or agent-held long-lived credentials.
* **Scoped authorization**: Agentic access flows limit who the agent can act for, which resources and permissions it can access, and how long access lasts.
* **Action-level guardrails**: Intent policies determine whether agent actions are allowed, require human approval, or are denied.
* **Traceable activity**: Agent identities and AI Sessions distinguish agent activity from human activity and record access grants, actions, and policy decisions.

Together, these controls allow organizations to adopt agentic workflows without creating a separate, less-governed access path.

***

### How Apono Agent Privilege Guard works

1. **Connect the AI client**. The client connects through the Apono Agentic Gateway.
2. **Make platform capabilities available.** Apono Managed MCPs expose supported operations through Model Context Protocol (MCP) servers. Enabling a Managed Tool makes its capabilities available but does not grant access to the target platform. The agent must still use an applicable agentic access flow, and its actions remain subject to intent policies. Depending on the integration, Apono provides access to the target platform through just-in-time credentials or the user’s OAuth authorization.
3. **Request scoped access.** An agentic access flow defines on whose behalf the agent can request access, the resources and permissions available to it, the access duration, and the approval process.
4. **Evaluate each action.** For every MCP tool call, the Apono Agentic Gateway classifies the action as **Read**, **Create**, **Update**, **Delete**, or **Admin** and applies the guardrail configured in that MCP’s intent policy.
5. **Record the activity**. The agent appears in AI Agents, while AI Sessions records its access grants, actions, and policy decisions.

***

### Get started

Choose the platform that you want agents to access.

Each end-to-end guide covers:

* Apono account prerequisites
* Agentic access-flow configuration
* Managed Tool enablement
* Agentic Gateway and AI-client setup
* Verification and troubleshooting

[Set up Apono Agent Privilege Guard for your platform](/docs/agent-privilege-guard/set-up-apono-agent-privilege-guard.md).


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.apono.io/docs/agent-privilege-guard/apono-agent-privilege-guard.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.