Guided services and the fixed agent
The agent and service Labs run real OAuth requests inside a lab case. Separate order, render and storage identities create a bounded photo-book metadata artifact.
Prepare a case
On a lab page, Start opens the case and sets up its people, album and services, and Guided services in Your lab case shows them. See Case labs. To prepare a case through tenant management instead, set a password for its temporary person, then add that person to the case under Resources in this case. Open OAuth Management > Guided Services, select the same case, and choose its person, recipient, album and fixed errand.
Prepare missing service resources creates four confidential clients for the case and separate order, render and storage resources. It reuses the ordinary Sample API resource. The confirmation identifies the supported Flow Policy grants and Sample API activation it may need. It preserves existing data; a conflicting existing authorization-detail type requires inspection through the normal controls.
Credentials stay sealed on the server. Refresh service credentials rotates only these clients and keeps each new secret with the normal credential-change Audit transaction. The fixed connector supports client_secret_basic and client_secret_post, chosen in the ordinary client controls.
Runtime choices
Reading, configuring and preparing Guided Services need separate permissions. The same controls are available in tenant management and BTL organization management. Their settings persist independently. Learner cases use their tenant-local users. BTL organization cases borrow existing staff who authenticate with their BTL account in their own home organization; adding them to a case gives no authority to remove them during cleanup. See BTL staff in BTL's own organization.
| Choice | Effect |
|---|---|
| Enabled | Disabling ends service instances, unused approvals and proven token leases. Re-enabling does not revive an old case. |
| Draft lifetime, threshold and currency | Drafts last 60, 120, 300, 600 or 900 seconds, bounded by the case. Amounts above the selected threshold require approval of that exact amount. The secure default threshold is 0. Currency is USD, EUR or GBP, each with 100 minor units per whole unit. |
| Agent run lifetime | A run lasts 60, 300, 600, 1800 or 3600 seconds, bounded by its case lease. Token policy still controls ordinary grant lifetimes. |
| Approval level and recency | Choose an existing tenant authentication level and a 60, 300, 600 or 1800 second recency. The sign-in methods used, the sign-in's age and current proofing state determine whether the level is met. |
| Maximum actor depth | Allow one to four authenticated clients in a retained chain. |
| Services, their clients and allowed callers | Select clients the case created, audience resources in the case, existing scopes and allowed callers. Render and storage may allow workload-only calls; a purchase always needs the person who makes it. |
| Caption decision and deliberate lost response | Choose a fixed decision for the case's photo captions, and optionally lose an order or storage reply after its effect is saved. Those choices apply only inside the selected case. |
Saving a case configuration ends its old agent runs and revokes their proven grants. A retired service client stays tied to its case, so changing a role cannot turn that client into an ordinary application.
The fixed agent
Launch fixed agent returns a one-time link. The tenant-hosted program discovers its current authorization server, signs the named person in with code and PKCE, and keeps its access and refresh credentials on the server. It reads only the case's configured album. Refresh sends the real refresh grant; Run performs the selected inventory or metadata-book errand.
The program follows fixed choices. It does not run tenant code, caption text or a language model's generated plan. Caption data can be ignored, cause a pause, or trigger a normal share request limited to the case's album and recipient. A share still needs the current scope and normal authorization. Asking for that scope changes the next real sign-in request; a caption cannot mint authority.
The order amount is a bounded teaching value selected before Run. The stored result is a real SVG of the case's photo metadata, with a digest. No payment or physical printing takes place.
Approving one transaction
The order service creates an immutable draft with its photos, recipient, amount/currency, user, acting client, order resource, version, expiry and generated one-use approval ID. The fixed agent sends a CIBA request carrying the registered btl_print_order authorization detail. This is a BTL profile extension; a generic CIBA sign-in approval does not authorize a purchase.
The person's Approvals page reads the draft from server storage and shows all its fields. A stale or invalid draft has no approval action. A configured recent or stronger sign-in uses the tenant's normal confirmation or step-up flow. Denial creates no order credential.
Submission checks the draft and the issued authority again, then consumes the one-use approval with the order and Audit event in one transaction. Changed fields, a different same-price draft, replay, concurrency and expiry cannot create another order. The tenant's current assurance policy still applies after approval.
Results and recovery
Order, render and storage use separate identities and target audiences. The user subject remains separate from the retained acting clients. Safe service receipts identify the case/generation/revision, client, subject, actor chain, audience resource, request and parent request, result and safe reason. Audit records accountability; Logs describes request execution.
The negative controls send real issued-token requests for a missing user, wrong audience, wrong caller, missing scope, changed order or repeated order. The browser cannot submit a verdict or turn a returned status into proof of the entire Lab.
If a response is deliberately lost after its effect is saved, the run keeps an unresolved result. Reconcile reads its retained draft and jobs, finishes only the remaining work and reads an already stored file rather than submitting or uploading it again. Do not launch a second purchase to find out whether the first one happened.
End authority and clean up
Stop ends one run. Stop this case's services ends the case's fixed runtime, cancels unused drafts and approvals, revokes its proven access/refresh tokens and exchange descendants, and erases sealed credentials. Case end, restart, expiry, reset, restore-seal changes and losing the permission that started the case also stop the services.
Use the lab's Delete this case's album and photos and normal management controls to remove only what the case created. Preserve borrowed resources, other applications and history. Ended service records have a 30-day retention period; a retired client's link to its case remains until the client is deleted so pruning cannot restore its authority. The tenant Usage view includes the registered Guided service records quota.