Agent Privilege Lab Guides
Hands-on guides for governing AI agents with PingOne Privilege: securing MCP servers with the AI Gateway, discovering self-hosted agents, registering agents, inspecting traffic with AI Guard, and exchanging user tokens on-behalf-of.
The guides form a sequence — each builds on the environment from the previous one.
| # | Guide | Focus | Verified |
|---|---|---|---|
| 1 | Configuring a Local AI Gateway with Docker | Run the gateway locally with TLS and sign-in | 2026-11-04 |
| 2 | Secure MCP servers with AI Gateway | Onboard an MCP server and grant tools by policy | 2026-11-04 |
| 3 | Discover self-hosted agents with the node sensor | Find agents and MCP servers inside containers | 2026-11-04 |
| 4 | Register agents with the Agent Registry | Give an agent its own identity and scoped access | 2026-11-04 |
| 5 | Inspect agent traffic with AI Guard | Block prompt injection and redact sensitive data | 2026-11-04 |
| 6 | Exchange tokens on behalf of users with OBO authentication | Preserve user identity in backend tokens | 2026-11-12 (draft) |
New here? Start with guide 1 and work down the table.
The source of truth for these guides is the i4ai-docs repository on GitHub. The Verified date records when each walkthrough was last confirmed end to end in the lab.