Understanding the Difference Between Per-User and Org-Wide Authentication
Per-user authentication keeps each person's own permissions in force. Org-wide authentication uses a single organizational identity for every agent call.
Table 1. Per-user authentication compared with org-wide authentication
| Per user | Org-wide | |
|---|---|---|
| Identity used | The individual user on whose behalf the agent acts. | A single organizational identity, shared by all agent activity. |
| Permissions applied | Whatever that user can already do in the business application. | Whatever the organizational identity can do. |
| Who authorizes | Each user, the first time their activity reaches the connector. | A System Administrator, once for the organization. |
| Effort to set up | Low for you, but each user must authenticate. | One-time setup by an administrator. |
| Best suited to | Agents acting on behalf of named people, where existing permissions should be respected. | Service agents and automation that run independently of any user. |
With either method, AI Security holds the credentials. Your agents never receive the real credentials for the business application.
Steps
- Determine whether your agents act on behalf of individual users or run independently.
- Determine whether existing user permissions in the business application should limit what the agents can do.
- Select the authentication method that matches.
Result
You know which authentication method to configure on the connector.
Next steps
Access policies apply in both cases. Use them to restrict which tools your agents can call, regardless of the authentication method.