AI Agent Identity Type - Authentication Restrictions, Behavioral Differences, and Recommended Configuration for Non-Human Accounts - Support and Troubleshooting

AI Agent Identity Type - Authentication Restrictions, Behavioral Differences, and Recommended Configuration for Non-Human Accounts Issue .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } Users with identity_type set to ai_agent on their sys_user record are unable to perform interactive logins or authenticate through any standard API or integration method, even when the Web service access only checkbox is disabled.

Symptoms .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } User with identity_type = ai_agent is redirected to "Logout successful" page upon an interactive login attempt Login failure logged in AuthenticationHelper with the following warning: [AI_Agent_Auth] Failing login attempt for AI Agent user . Details: user: interactive:true identity_type:ai_agent auth_type:multisso Authentication fails across all methods including SSO, OAuth, OIDC, HTTP Basic Auth, and certificate-based auth No failed authentication entry visible in the sysevent table or system logs for the affected user Issue persists after upgrading the spoke or changing SSO/IdP configuration The identity_type field becomes read-only in the UI after being set to ai_agent Account cannot be impersonated Facts .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } The identity_type field was introduced on the sys_user table to classify user records as Human, Machine, AI Agent, or Unclassified This feature was introduced in the Australia release and is not natively present in previous Family Releases The ai_agent identity type is designed for autonomous, non-human platform-to-platform operations and is not intended for interactive UI access The Machine identity type auto-sets web_service_access_only = true , restricting the account to API and web service access only but allowing all standard non-interactive authentication methods The AI Agent identity type auto-sets web_service_access_only = false but applies hard-coded Java-level authentication blocks across all standard auth pathways The documentation statement "The Web service access only check box is automatically disabled when you select Human or AI Agent" means the checkbox is cleared as a prerequisite - it does not grant interactive login capability for AI Agent accounts AI Agent accounts are blocked from the following authentication methods: Certificate-based (mutual auth) OAuth and OIDC HTTP Basic Auth Script-based auth (HTTPAuthenticate) SSO / Multi-SSO interactive login The only successful authentication path for an AI Agent account is the internal KAA JWT service-to-service assertion flow , which is an internal platform-to-platform mechanism not accessible to end users or standard integrations If identity_type is set via an LDAP import field map, the next LDAP sync will overwrite any manual changes made to the field on the sys_user record Additional Restrictions Specific to AI Agent (Not Applicable to Machine):

The identity_type field becomes immutable once set to ai_agent The identity_type field becomes read-only in the UI The account is excluded from impersonation Edits to the account require elevated ACL permissions Release .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } Australia release and subsequent releases with Identity Type functionality

Cause .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } The platform enforces a hard-coded Java-level authentication block for all accounts with identity_type = ai_agent via the AuthenticationHelper class. This block fires upstream of and independently from any SSO or IdP configuration, meaning changes to the external identity provider will not resolve the login failure. The [AI_Agent_Auth] enforcement is by platform design and is not a misconfiguration.

Resolution .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } Determine the Correct identity_type Based on Use Case:

Option 1: Account Requires Interactive Login (Recommended for Non-Human Accounts Needing UI Access)

Navigate to User Administration > Users Open the sys_user record for the affected account Change the identity_type field to Human or Unclassified Human is appropriate if the account represents an individual performing interactive work Unclassified is appropriate for non-human accounts that require interactive access but do not fit the Human classification Save the record Test interactive login to confirm the [AI_Agent_Auth] block is no longer triggered Important - LDAP Field Map Consideration: If identity_type was set via an LDAP import field map (e.g., mapping all accounts in an Active Directory OU to ai_agent ), the next scheduled LDAP sync will overwrite the manual change. To apply a durable fix:

Update the LDAP field map transform to exclude accounts that require interactive access Add a condition or exclusion rule for specific accounts in the transform map Verify the scheduled LDAP import interval to ensure the fix is not reverted before testing Option 2: Account Must Remain Classified as ai_agent

Interactive login is not supported for this identity type by platform design. The recommended approach is:

Create a separate sys_user account with identity_type = Human or Unclassified for any interactive access requirements Retain the ai_agent account exclusively for internal platform-to-platform API and agentic workflows Confirming the Root Cause via Logs:

To verify that the [AI_Agent_Auth] block is the root cause, review the node logs for the following pattern:

AuthenticationHelper WARNING *** WARNING *** [AI_Agent_Auth] Failing login attempt for AI Agent user . Details: user: interactive:true identity_type:ai_agent auth_type:multisso If this log entry is present, the authentication failure is caused by the identity_type = ai_agent restriction and is not related to SSO, MFA, or IdP configuration.

Important Notes:

Changing identity_type from ai_agent to another value may not be possible through the UI once set, as the field becomes read-only. Use a background script or elevated admin access to modify the field if needed Do not attempt to resolve this issue by modifying SSO or IdP configuration alone as the platform block fires before SSO response processing completes The Enable MFA field and Web service access only checkbox do not influence the [AI_Agent_Auth] block