Make actions accountable
Use one agent safely for many customers
Let a product invoke the same agent for many customers without turning their tokens into reusable connections.
Give each invocation only that customer's credentials, then remove them when the work ends.
What this changes for your team.
In caller mode, credentials supplied with a request are encrypted and used only for that run or message. They replace stored credentials for the request and are deleted when it ends. If a crash interrupts cleanup, automatic cleanup removes the remaining credentials within the documented time limit.
How it works in practice.
- 01
Send the declared caller credential fields with an authenticated machine request.
- 02
Encrypt the fields into a grant tied to the new run and resolve them only for caller-mode tools.
- 03
Delete temporary credentials when work ends, and clean up any left behind after an interruption.
What you can plan around.
What to expect, including limits that matter to your team.
Caller grants are execution-scoped and never become selectable saved connections.
Supplied fields replace, rather than merge with, stored credential fields.
Temporary credentials are deleted when work ends, or within the documented cleanup window after a crash.
A refresh token sent beside the access token renews it when the provider rejects it - still the end user's token, never your organization's - and a flow's test run can take a per-connection token held only for that run.
Bring one real process
See how Yekar.AI fits the way you work.
Start with a job your team already owns, plus the tools and decisions around it.
Get started