Identity

Ramp supports two identity models. Use a user identity when an agent assists one person. Use a standalone identity when the business wants an agent to own work, permissions, and its lifecycle independently.

Agents acting on behalf of users

MCP and CLI actions run as the Ramp user who completed OAuth. Visibility and actions follow that user's permissions. If Sarah connects Ramp, her agent sees the same Ramp businesses, cards, funds, and workflows Sarah can access.

Admins can manage which users have access to MCP connectors via the Integrations page in app.

Agents with their own identities

Standalone agents are first-class virtual employees on Ramp. They have their own credentials, explicitly assigned permissions, an accountable human owner, and a lifecycle that the business manages independently. Standalone agent identities are in limited early access.

Example: first-level bill review

An invoice review agent can compare hundreds of line items with the company's system of record, approve clean bills, and send mismatches to a person. The agent appears in the approval chain under its own identity instead of making every decision under an employee's account.

Controls for standalone agents

• Least privilege: The agent starts with minimal access. An admin grants only the permissions required for its job.
• Human ownership: Every standalone agent has an accountable Ramp user who owns its setup and operation.
• Immediate control: Admins can pause access, rotate credentials, or remove the agent independently.
• Separate attribution: Supported activity identifies the agent instead of borrowing a person's identity.

Adding an agent to an approval workflow does not grant authority by itself. The agent must also have the permissions required to review or approve that work.

Optional: Create an agent identity

Use this path only when a business needs a separately managed identity for shared or background work. It is not required for an agent acting on behalf of the connected Ramp user.

1. Choose the role

Use the narrowest default role that fits the agent's job, or create a custom role when no default applies. A purchasing agent's role must include the relevant payments capabilities before it can purchase. Creating custom roles requires a role admin and a business integration with users:read and users:write access.

2. Create the agent

In Ramp, open Company → Agents, select New agent, enter a name, choose its role, and assign an active human owner in the same business. The business integration needs agents:write.

3. Save and connect credentials

Ramp returns a Client ID and show-once Client secret when the agent is created. Store both in a secret manager, not in the agent's instructions. Connect the runtime with those credentials only after the agent is set up; future actions then run under the agent's identity rather than a user's OAuth connection.

Reach out to the team to request early access to standalone agent identities.