Skip to content
BailingHubAGENT-TO-BUSINESS

Agent Client browser authorization and local orchestration

Agent Client is an optional v0.5.x surface. The local agent owns understanding, planning, and multi-step tool selection. BailingHub retains revocable business identity, route and capability filtering, approval, idempotency, business invocation, recovery, audit, and the visible conversation ledger.

It does not replace /run, embedded chat, Client API, or the Executor Protocol.

Responsibilities

Section titled “Responsibilities”
Party Responsibility
Business system Login, account/tenant selection, trusted subject derivation, final permissions and state checks
BailingHub Client App, workspace, capability projection, approval, invocation, revocation, and audit
Local agent/plugin PKCE initiation, secure credential storage, local planning, tool selection, and user interaction

Setup flow

Section titled “Setup flow”
  1. The business system exposes an account- and tenant-neutral agent_authorize_url and derives identity from the current login session;
  2. the BailingHub deployer enables Agent Client on a client and route and selects exact writable operation IDs;
  3. create a Client App in the Agent Client management center and obtain its public clientAppId;
  4. the plugin starts browser + PKCE authorization; the user signs in, selects an account/store, and confirms;
  5. the plugin discovers a workspace, reads bounded bootstrap context, searches capabilities on demand, and invokes governed tools;
  6. administrators inspect Agent Sessions and run statistics and may revoke sessions individually.

Data that never enters the local agent

Section titled “Data that never enters the local agent”
  • Model-provider credentials;
  • Tool Provider Secrets;
  • Client Tokens or admin tokens;
  • internal business API URLs and full target_config;
  • hidden chain-of-thought.

Writes and approval

Section titled “Writes and approval”

Routes store exact writable operation IDs, not wildcards. Local planning never weakens ACC approval declarations; additional forced approval may only tighten them. The business endpoint still reauthorizes immediately before a write.

Multiple connections

Section titled “Multiple connections”

One plugin may store multiple hubs, Client Apps, or business identities and requires explicit user selection. Reauthorizing the same identity replaces only that identity; revoking one connection must not damage the others. A local connectionName selects a connection instance—it cannot name or forge a business identity.

See the fixed v0.5.1 Agent Client Integration Guide.