AI agent attribution

Trace the agent behind every query.

The MCP server records an agent ID, environment, workspace, and host context supplied by the local deployment. This separates activity without overstating it as access authentication.

Get early access
Review the security model →

Why this exists

Attribution today; verified workload identity next

SB_AGENT_ID and related settings give each MCP installation a stable label. Without one, Safe Boundary derives a best-effort local identity so evaluation audit remains useful.

The database connection still uses DATABASE_URL. An agent key can authenticate the optional audit uplink, but it does not replace or revoke the database credential.

What it does

Concrete controls, stated precisely.

Stable agent label

Attach a configured agent and environment to query, mask, and block events.

Best-effort fallback

Derive local host and workspace context when explicit metadata is absent.

Audit uplink authentication

Use an agent or console key to protect best-effort console delivery.

Local configuration

Give each agent path a stable label without confusing it with auth.

Illustrative environment names; the database credential remains the authority for PostgreSQL access.

MCP environment

SB_AGENT_ID=analyst-tool
SB_AGENT_ENV=staging
SB_AGENT_WORKSPACE=finance
DATABASE_URL=postgresql://readonly@db.internal/app

Audit interpretation

Agent label: useful correlation
DATABASE_URL: database authentication
Optional agent key: audit uplink only
Not implied: verified workload identity

How it works

A visible enforcement sequence.

  1. Name

    Assign a stable SB_AGENT_ID to the MCP deployment.

  2. Contextualize

    Add environment and workspace metadata.

  3. Enforce

    Run database tool calls through the local MCP server.

  4. Correlate

    Filter audit events by agent attribution and outcome.

Protected when

  • ✓Audit separation between MCP installations
  • ✓Local policy enforcement on the named tool path
  • ✓Authenticated optional console delivery

Important boundaries

  • •The label is local input, not cryptographic workload proof
  • •Revoking the audit key does not revoke DATABASE_URL
  • •Per-agent policy and durable cross-session quotas are not current capabilities

Continue the story

Related Safe Boundary pages

MCP server →

Give AI tools a bounded PostgreSQL query surface with local audit.

Identity and access →

Compare identity provenance across all surfaces.

Security model →

Understand trust boundaries, credentials, identity, and bypass conditions.

Test the boundary on a real access path.

Start in observe mode and validate the policy against representative traffic before you enforce it. That gives the team evidence for each decision, along with explicit bypass controls for the cases that need a deliberate exception.

Get early access