Identity Engine

Map agents, users, and environments in the identity graph; enforce identity_policy.

What you will learn

• identity_get
• identity_plan
• identity_enforce

Prerequisites

• Mount PluginHost and merge MCP tools

Surface

What this feature does

Identity Engine binds who/what may act: agent ids, human approvers, environment principals.

How to call it

Call these MCP tools through your AGS / tower-gov host — identity_get, identity_validate, identity_enforce, identity_plan.. Prefer scan/get before validate/diff, and enforce only when the change set is ready.

1. identity_get
2. identity_plan
3. Apply remediation
4. identity_enforce

{
  /* Example MCP call — fill args from schema_get / docs */
  "tool": "identity_get",
  "arguments": {}
}

What success looks like

identity_enforce ok

Policy matches live state

Common failure modes

Config enabled but requiredFiles missing

Enforce without validate

Plan ignored

Related reference

• Configuration
• Architecture