FeatureOctober 7, 20261 min read
Pass verified user identity to your agent's tools
Give your APIs a signed, short-lived identity assertion for the user behind an agent request, without asking the model to choose the user or tenant.
identitytoolsmulti-tenancy
Tools can receive a short-lived, audience-bound identity token signed by Runtype. Your service verifies the signature and uses the asserted user and tenant to apply its own authorization rules.
The token comes from the execution's admitted identity. The model does not choose the identity or read the credential. Saved MCP servers and opted-in external agents can receive the same kind of assertion, and self-hosted runtimes can supply their own signer.
This establishes who the request represents. Your receiving service still decides which data and actions that identity is allowed to access.