People and services
The subjects that the IdP directory provides, and how they appear in agent configuration.
An agent acts for a subject, and the subject can be a person or a service. Both come from the directory of the connected IdP and enter delegation the same way.
- People are directory users: a support analyst, an on-call engineer.
- Services are non-human identities that the IdP issues to a customer system, such as a client with a service account in Keycloak or a Google service account. A release pipeline that calls tools with nobody behind it is a service.
The Admin shows both kinds side by side and marks the kind with a chip. When you choose who can delegate to an agent, the provider panel has a People section and a Services section, each with search, count and Select all (Delegation and access).
Why the Admin asks the provider
Before a subject enters a delegation, the provider confirms that it exists. So a typo or an already removed user does not become a delegation for nobody. After that, Xokepoint does not follow the user lifecycle in the IdP: someone disabled there stops getting tokens, and the next token exchange fails (Revocation).
Select all checks every subject the directory lists at that moment. Someone created in the IdP later is not included automatically: you add them and publish again.