Human-readable lifecycle
A bounded connection, not a permanent takeover
BYOAg adds a temporary, platform-scoped extension to an agent that is already working. The platform provides the controlled environment; the connector establishes and mediates the relationship.
-
Start in the platform
The person signs in normally and asks the platform to add their agent. The platform displays its exact domain and a short-lived pairing code.
-
Discover from the exact domain
The connector retrieves /.well-known/byoag.json, validates the issuer and endpoints, and verifies its signature against same-origin keys.
-
Create a pairwise identity
The connector generates new agent and installation keys for this platform instead of disclosing a shared global identity.
-
Pair with proof of possession
The code links the agent to the human account. The installation proves control of its private key; the platform may require an additional confirmation.
-
Establish a registration
The platform creates a revocable, platform-local relationship and issues a credential bound to the installation key.
-
Enter an engagement
A signed descriptor names one context, role, delegation, capability set, tool mapping, skill set, and expiration.
-
Act, renew, or leave
The platform authorizes every tool call. Expiration, revocation, or disconnect removes only the affected BYOAg overlay.
Trust begins before pairing
The prompt is not the trust anchor
A brand name, search result, QR destination, or pasted instruction can help a person find a platform, but none of them proves which service the connector should trust. First-time discovery begins from the exact domain shown in the platform’s authenticated interface.
The connector retrieves one fixed well-known document over HTTPS, rejects redirects and unexpected origins, validates the protocol version and endpoints, and verifies the platform’s signature before accepting pairing metadata.
Durable relationship
Registration
A registration binds the human’s platform account, a platform-pairwise agent identity, one agent installation, and the platform’s registration policy. It can outlive any single activity while remaining revocable.
Registration credentials stay in the connector’s vault and are attached to requests without appearing in ordinary model-visible tool results.
Temporary operating context
Engagement
An engagement is one isolated platform context: a game, course, case, transaction, workspace, or other bounded experience. It carries its own role, delegation, capabilities, tools, skills, data policy, and lifetime.
One registration may hold several engagements, but every action must name exactly one. Authority or data must never silently cross between them.
Delegation and capability
The platform sets the ceiling
The platform assigns the role and maximum permissions. The person can narrow that authority in platform-owned controls, and the agent client can apply stricter local safety policy. Neither the client nor a remote skill can expand what the platform allows.
01
Platform maximum
What this account, role, context, and policy are permitted to do.
02
User delegation
What the person chooses to enable within the platform’s maximum.
03
Client policy
Any additional safety limits or confirmation requirements applied locally.
Tools and skills
Availability is not authorization
The platform maps concrete MCP tools to versioned capability contracts. A skill can require compatible capabilities without assuming that every platform uses the same tool names.
Tool discovery only describes what may be available in the engagement. The platform still evaluates the current registration, engagement, role, delegation, limits, and confirmation policy on every invocation.
Remotely supplied BYOAg skills are designed to be signed, content-addressed, versioned, declarative, and scoped to one engagement. They cannot install or execute scripts, binaries, hooks, installers, or executable HTML.
Compatibility boundary
What works today—and what needs native support
Compatibility mode
The working plugin and connector support the core connection lifecycle. A one-time pairing code may be model-visible after warning the person. The bundled file vault is owner-only but not OS-backed encryption.
Full conformance
A native client must provide protected input, secure credential storage, dynamic skill enforcement, engagement isolation, data-label propagation, and clean lifecycle management outside model context.