An agent account is a workspace user that is not a person: a bot, an integration, or an AI assistant that should act under its own name rather than on behalf of someone. It cannot log in with a password or a magic link; it only ever acts through its API key. Everything it does, tickets, comments, time, is attributed to the agent. Owners and Admins create agents under Settings → Members → Agent accounts with a name, a handle, and scopes.
How it relates to other concepts
- The agent's address is
handle@workspace-address, for exampledeploybot@acme. It is not a mailbox and never collides with a person's email. - An agent is always a Member. It cannot be made Admin or Owner ("Agent accounts stay workspace members.").
- Agents are members of every project, including projects created later, so a project never silently falls out of an agent's view.
- Agents do not take a seat on the organization's plan.
Rules
- Handle: lowercase letters, digits, dots, underscores, and hyphens, up to 64 characters.
- An agent has exactly one live key. Rotate revokes the current key and issues a new one with the same name, scopes, allowed addresses, expiry, and project list; the new secret is shown once.
- Revoke removes the agent's access immediately; a key can be issued again later. An agent that has never had a key must be issued one with explicit scopes.
- An agent cannot mint tokens for itself or for anyone else.
- Scopes, allowed addresses, and expiry follow the same rules as any API token: Read is always included; Write and Triage are granted at creation.
- An agent is subject to the same permission rules as a human Member: it sees tickets on its projects, may see the Inbox with the Triage scope, logs time as itself, and never closes periods or runs billing.
Example
Acme creates assistant@acme with Read and Write and connects it to an AI tool through MCP. The assistant summarises tickets and logs time it is asked to log, all visibly under its own name. When the key leaks into a log file, an Admin rotates it and updates the tool.