What is a connection?
A connection binds an approved action to a particular account on the target system, and carries the credential reference used when that action executes.
Separating the action from the connection is what makes multi-tenant agents tractable. One reviewed "create ticket" action can run against many customer accounts, each through its own connection, without re-reviewing the action per customer.
It also localises credential rotation: replacing a secret updates one connection rather than every place the action appears.
A connection stores a secret:// reference, never a credential value. The runtime resolves it inside the execution layer after the policy decision, so the value never reaches the model or the trace.
Related terms
- Integration — An external system an agent can reach, together with the specific actions that were reviewed and approved on it.
- Service account — A non-human identity used by software to authenticate, carrying only the permissions it was granted.
- Secret reference — An opaque pointer to a credential held in a vault, used in place of the credential itself.
See it working rather than described.
The product demo runs one agent across three systems and stops at the approval gate.