API ReferenceBlogSign inGet started
GuidesDetectEnforceGovern

Control Access

Configure agent permissions, consent screens, and tool protection from the dashboard

Overview

Control Access is the legacy dashboard surface for Govern configuration. Most of what it covered (provider and auth-method configuration, consent branding and copy, and per-tool protection) now lives at Policy → Auth:

/dashboard/{orgId}/{projectId}/policy/auth

Every capability below now has a control at Policy → Auth. The legacy Control Access pages still resolve:

/dashboard/{orgId}/{projectId}/control-access/{config,consent,tools}   (legacy surface)

What Moved to Policy → Auth

The Policy → Auth page walks one three-screen journey (Auth → Consent → Success) and covers:

  • Auth methods and providers: Configure OAuth providers, credential providers, or consent-only access, and the scopes each protection grants
  • Consent branding and copy: Customize the consent and success screens agents see
  • Per-tool protection: Assign each discovered tool an owning protection in the tool coverage table; unassigned tools stay open

For the underlying concepts, see Authentication Methods, Consent Flows, and Tool Protection.

Legacy Pages and Their Policy → Auth Controls

CapabilityIn Policy → AuthLegacy page
Tool listCard 02 Tools table: filled by server registration, first calls and discovery; assign protection.../control-access/tools
Running discovery, removing a toolCard 02 Tools table: Discover tools in its header, Remove tool… in a tool's menu.../control-access/tools
Per-tool scope displayCard 02 Tools table: the scopes a tool declares, under its name.../control-access/tools
OAuth scope refreshCard 02, the OAuth method's Scopes field: Refresh scopes; a save that carries the Client secret also refreshes them.../control-access/config
Terms of Service / Privacy Policy URLsConsent screen, Legal links: Terms of Service URL, Privacy Policy URL and Require terms acceptance.../control-access/consent
Secondary brand colorConsent and success screens, Branding: Secondary color.../control-access/consent
Connect-page previewConsent screen, Connect page: Preview connect page.../control-access/consent?tab=connect

These legacy pages still resolve and work. They are no longer the primary surface: manage all of the above at Policy → Auth.

Consent configuration can be read via the API:

GET /api/v1/bouncer/projects/{projectId}/consent-config

The endpoint is read-only: edits happen in the dashboard consent editor at Policy → Auth. See Consent Flows for details.

Next Steps

GitHub Connections

Let users connect their GitHub account to the Vouched KYA gateway for OAuth-backed tool calls

Migrating MCP to KYA-OS

Add identity, authorization, and governance to an existing MCP server

On this page

OverviewWhat Moved to Policy → AuthLegacy Pages and Their Policy → Auth ControlsConsent Configuration via APINext Steps