10Operation policies, attribute policies and agent supervision

SYNERGY Management Gateway gives you three complementary sets of controls over what happens in your directories:

• Operation policies decide, for each individual operation the platform can perform (for example "Delete user" or "Add group member"), whether it may run at all, whether it is recorded in the operations log, and whether an AI agent or integration must always ask a person before making it.
• Attribute policies decide, for individual directory attributes (for example the Exchange attributes that only Exchange should change), whether anyone may change them, or see them at all.
• Agent supervision decides how far a particular machine credential — an API key or a connected AI agent — is trusted to change a directory on its own, and which of its changes wait for a person to approve.

Operation policies, attribute policies and agent supervision apply only to machines when it comes to approval. A person signed in to the console is never queued for approval: their request either runs or is refused on the strength of their permissions. Approval exists to keep a person in the loop when software acts on someone's behalf.

Attribute policies never queue anything: they apply to people and machines alike, and a forbidden change is simply refused.

This chapter explains these controls, the screens you use to manage operation and attribute policies, and the safeguards that apply to every agent whatever its level. How approvals are decided once an operation is waiting is described in Chapter 9, Operations log, approvals and waiting operations. How to create API keys is described in Chapter 12, API keys, and how AI agents connect is described in Chapter 13, AI agents (MCP server).