Three agent-facing updates shipped this week: scoped credentials on every downstream agent call, pre-promotion regression replay for prompt changes, and a full documentation guide for the Agent ROI dashboard.
Scoped, auditable credentials on every agent call
AI agents act downstream — LLM tool calls, MCP server integrations, paid API calls — and until now those actions tended to run on whatever ambient session token the agent happened to hold. Orbit by Devotel's agent runtime now speaks OAuth 2.0 Token Exchange (RFC 8693) at POST /agents/:id/token-exchange.
An agent that already holds a scoped access token can present it, along with its own actor token, and receive back a shorter-lived credential narrowed to exactly the tools the task at hand requires — never wider than what it already held. The exchanged token carries a signed delegation chain naming the agent and the human sponsor accountable for it, so a security review can answer three questions from the credential itself: which agent did this, on behalf of which person, with which permissions. Requests that try to impersonate without attribution are refused.
For teams putting agents in front of customers or letting them touch paid APIs, this moves the audit story from log correlation to cryptographic proof embedded in the token.
Prove a prompt before you promote it
Agent regression tests — the saved conversations under an agent's testing panel — now support a pinned prompt version. When you replay the set, the harness runs each saved conversation against that frozen prompt instead of whatever config is currently live.
A run can also override the pin with a candidate version id. That lets you score the entire saved corpus against the prompt you are about to promote, before it goes anywhere near production. The live agent is untouched, and the replay runs in the same sandbox mode as the studio test panel.
The practical change: a regression suite used to be able to tell you a prompt still worked only after the change went live. Now promotion is gated on evidence. Catch the regression, roll back, iterate — promotion gates and saved test runs stay aligned either way.
A guide for reading Agent ROI
The Agent ROI surface — per-agent AI cost against the attributed revenue of resolved outcomes, with a daily trend and a pricing config — shipped with endpoint reference but no direction on what the assumptions should be. A new Guides → Agent ROI attribution page closes that gap.
It covers what ROI actually measures, the summary, trend, and config surfaces, how the value-per-outcome config behaves as a read-merge-write with per-rubric overrides, how to read margin per agent, and the role scope (owner, admin, developer, billing) that gates the numbers. Attribution numbers are only as meaningful as the assumptions behind them; the guide shows how to set a defensible per-outcome value so the per-agent margin is worth acting on.
What this adds up to
AI agents in production are judged on three axes: can you audit what they did, can you prove a change is safe before it ships, and can you tell whether the agent pays for itself. This week's updates cover all three. Scoped token exchange handles attribution, pinned regression replay gates promotion, and the ROI guide makes the cost-versus-outcome numbers readable. You can find each in the dashboard and in the Orbit by Devotel docs.