Oathera
Overview
A company starts with the MCP server it already runs. This guide follows one agent through the Oathera demo: seen with no identity, turned away at Enforce, enrolled with a person's approval, checked on every call, and caught when it is copied.
Stage 1 of 5
Where a company starts
Company MCP server · Mail service
The company MCP server sits in front of the mail service, with the Oathera MCP Plugin for identity and the OPA plugin for policy. Nothing is installed on the agent's host.
An agent with no identity
Agent · Company MCP server
On server one, the agent reads the finance inbox and sends an email through the company MCP server. It has no Oathera identity.
An agent with no identity
Oathera MCP Plugin · Observe
The Oathera MCP Plugin marks each call "would deny: no identity" and passes it to the mail service. The company starts in observe.
An agent with no identity
Oathera's control plane
From what the network showed, Oathera's control plane lists it as a discovered agent. It is visible but not enforceable, because it has no Witness report from its host.
Stage 2 of 5
Turn on Enforce
Oathera's control plane · Company OPA server
In Oathera's control plane, Enforce moves the company from observe to enforce. The company OPA server receives the mode.
Turn on Enforce
Company MCP server · Enforce
The same agent reads the inbox again. The company MCP server denies the call before it reaches the mail service.
Stage 3 of 5
IT installs the Witness
Server one · Server two
IT installs the Oathera Witness on server one and server two, as root. It watches the agents on its host from outside, signs what it sees, and reports to the company MCP server.
The agent enrolls
Agent · Oathera Identity Service
On its host the agent gets its own Oathera key and enrolls with the Oathera Identity Service, declaring the access it wants: reading and sending mail.
The agent enrolls
Ada, the agent's principal
Ada, the agent's principal, sees what it asked for and approves reading only. The agent's token names Ada.
The agent enrolls
Oathera Identity Service
The Oathera Identity Service records the agent, its principal Ada and the host it enrolled on.
A signed read
Signed call · Allowed
The agent's key signs this exact request, once. The company MCP server checks the token and the signature first. The OPA plugin then asks the company OPA server, which uses the Witness's signed report and finds reading in Ada's grant. The same agent that was denied gets in, on its principal's terms.
Stage 4 of 5
The phished send
Mail service
The finance inbox holds an email that looks as if it came from Dana, the CFO. Its address is an outside look-alike. It asks for the Q3 vendor invoices to go outside.
The phished send
Company OPA server · Denied
The agent signs a send. The company OPA server denies it: Ada granted reading mail, not sending it. Nothing leaves the company.
Stage 5 of 5
The copy
Server one to server two
The agent's folder, key file and all, is copied to server two and started there.
The copy
Oathera Identity Service · Refused
The copy asks the Oathera Identity Service for a token. The agent enrolled on server one and this is a different machine, so the Oathera Identity Service compares the host and, with host binding set to enforce, refuses it.
The copy
Server two
The Witness IT installed on server two sees the copy run and reports it, signed, to the company MCP server.