docs

Guides

Get started

What is OAP?
Install — overview
Installing with oap init
Install on Desktop (macOS)
Install on a cluster
Your first agent

Agent builder

The agent builder
Turn on the agent builder
Your first custom agent
Testing, delivery, and install
Workshops and limits

Example agents

codebot
hubspot-companies
reviewbot
pm-bot
Agent Builder

Concepts

Agent definition
Safe tools
Identity & credentials
Authorization
Channels & continuity
Memory & knowledge
Artifacts
The life of a session
Subagents & delegation
Settings & tiered configuration

Admin console

The admin dashboard
Live activity
Agents, tools & skills
Channels & directory
Identity, users & access
Memory, knowledge & artifacts
Audit log & budget

Operations

Revocation
Health & upgrades

Security

OWASP Agentic Top 10

Reference

Agent definition

AgentClass & AgentSession
The agent loop
Skills
Packaging (.oap bundle)
Workspaces

Safe tools

Toolspec & validation
Sandboxed execution
MCP servers & sidecar toolboxes
Content guards & egress
Budgets, rate limits & circuit breakers
Supply-chain pinning

Identity

Identity modes
User-passthrough vs. agent-identity
Choosing identity per session
Giving an agent credentials
Enterprise managed auth
Managing your connections
Identity providers & sign-in

Authorization

Multiplayer sessions in Slack
Plan gating & approvals
Shared permissions
Information leakage & egress

Channels

Slack
Browser web chat
Local terminal
Continuity & interactions
Triggers: webhooks & schedules

Memory

Storage, search & the knowledge graph
Facts & observations
Per-subject authorization
The tamper-evident audit log

Artifacts

Revisions & versioning
Annotations & tags
Rendered inert
Delivery & completion

CLI

CRD reference

oap logout

Remove the cached identity assertion

Docs CRD reference CLI reference OWASP coverage Community

Built by AuthZed, using SpiceDB. Open source under the Apache 2.0 license.

Color themeLightDarkSystem