Agents are first-class operators
There are two ways to add AI to a product. The common one bolts a chatbot to the side: it answers questions about the product, but it cannot operate it — it has no identity, no permissions, and no accountability. The other way makes the agent a real actor inside the system, governed exactly like a person. openbis.tech takes the second way.
An agent is a session
On openbis.tech, an agent is a session tagged as an agent. That single fact carries everything:
- It authenticates — the agent has an identity, not an API key smuggled into
a prompt.
- It holds scopes — the same permission scopes a person holds. An agent can
do what it is authorised to do, and nothing else.
- It reaches the same surfaces — the agent calls the same tRPC procedures
through an MCP server that a person reaches through the web UI. There is no privileged back door; there is one governed front door.
- It is audited — every action an agent takes is attributed, the same way a
person's actions are.
Define once, reach everywhere
Because a capability is defined as a governed action rather than wired per-surface, exposing it to agents is a property of the definition — not a second implementation. Anything a person can be authorised to do, an agent can be authorised to do, through the same permission ladder.
Tenants own their agents
Governance does not stop at the platform boundary. Each tenant defines its own agents, holds its own credentials, and grants its own access. An agent belongs to a tenant the way a member does — fenced by the same row-level security, governed by the same roles. There is no shared operator reaching across tenants; there is one agent per tenant, inside that tenant's boundary.
Why "first-class" is the whole game
A bolt-on chatbot is safe because it is powerless. A first-class operator is powerful, which means the only thing that makes it safe is governance. By making agents ordinary scoped actors — no special path, no elevated trust — openbis.tech gets to give them real work without giving up the guarantees that protect everyone else.
The result: agents that author documents, answer questions, and run workflows — inside the product, under the same rules as the people they work beside.