Agents

Agents are the primary identity in RenLayer. Every trace, policy, and rate limit is anchored to an agent, and every API key is scoped to an agent. The Agents page is where you register, configure, and rotate them.

Registering an agent

To create an agent, click New agent and provide:

• Name: human-readable; appears in the dashboard and audit log (e.g. support-bot-v1).
• Description: optional one-liner so other operators know what this agent is for.
• Upstream: the model provider or tool API the agent will talk through (OpenAI, Anthropic, an internal model-serving endpoint, an MCP server).
• Default policy set: which policies this agent inherits from the tenant defaults.

When you save, the console returns the agent ID and an initial API key. The API key is shown once; copy it into your secret manager immediately.

API keys

Each agent can hold multiple active API keys at once, which makes rotation safe:

1. Generate a new key.
2. Roll it out to your agent’s secret store alongside the old key.
3. Switch traffic to the new key.
4. Revoke the old key.

Revocation is immediate and propagates to every proxy instance on the next request.

Per-agent rate limits

The agent’s Limits tab exposes per-agent and per-user rate limits (requests/minute, tokens/minute, daily ceilings). See rate limits for the model.

Upstream configuration

The Upstream tab controls where the proxy forwards this agent’s traffic. You can:

• Override the base URL (useful for routing to staging vs production endpoints).
• Inject upstream headers (e.g. an upstream API key, kept server-side, never exposed to the agent).
• Pin the agent to a specific model.

Header injection is the recommended pattern for keeping your real OpenAI key off the agent’s host, the proxy holds the secret, and the agent uses only the RenLayer-issued key.

Sessions for this agent

The agent detail page includes a filtered Sessions view so you can see this agent’s traces in isolation. Useful when triaging a single misbehaving agent without losing the wider context.

Audit and history

Every change to an agent (created, key minted, key revoked, upstream edited, limit raised) is recorded in the audit log with the operator, timestamp, and diff.

EU AI Act compliance review

The agent detail page includes an AI Act tab that classifies the agent under the EU AI Act (Regulation (EU) 2024/1689) and turns the result into actionable remediation. It is a compliance triage aid, not legal advice; borderline cases are flagged for human review.

How it classifies

The classification combines three inputs:

• The agent’s repository, connected through the same GitHub flow as the MCP Registry audit, for lightweight signals (tech stack, integrations, README).
• A functional description of what the agent does, in your own words.
• A short guided questionnaire (use-case domain, personal data, decisions about people, chatbot interaction, synthetic content) that anchors the tier, since the EU AI Act category depends on the use, not only the code.

You choose the language of the report when you launch it (it defaults to your console language).

What the report contains

• Risk tier: prohibited (Art. 5), high (Annex III or an Annex I safety component), limited (Art. 50 transparency), or minimal, with a confidence level and a 0–100 risk score. It also flags GPAI where relevant.
• Rationale mapped to the specific Annex III category or Article.
• Obligations checklist for the tier (risk management, data governance, technical documentation, logging, transparency, human oversight, robustness, conformity assessment, EU-database registration), each marked met, partial, missing or unknown.
• Gaps: concrete shortfalls inferred from the inputs, with a severity.

Correction plan

For every obligation and gap, RenLayer generates a ready-to-paste correction: a procedure, policy or technical-documentation section written for that specific agent (e.g. an Art. 9 risk-management procedure or an Art. 14 human-oversight protocol) that drops straight into your management system. The full report exports to a PDF compliance dossier.

Plans and roles

Classifying an agent (tier, confidence and rationale) is free. The detailed obligations checklist, the gaps, the correction texts and the exportable dossier are part of the paid plans, and the gating is enforced server-side. Starting, re-running or deleting a classification requires the Owner or Admin role.

Where to go next

• Policies: write rules that target specific agents.
• Sessions: investigate what an agent did.
• MCP Registry: security-audit MCP servers before an agent connects.
• Audit log: the immutable, EU AI Act-mapped trail of every change.
• Proxy: deployment: how to point your agent at the proxy.