Run Agents Inside Your App
After an agent exists, you need to choose the session type first, then choose the runtime UI model.Two agent session types
agent_access tickets support two session identifiers:
staticsignin
static session
Use this when your backend wants full control over conversation partitioning.
- You must send
context_groupin the ticket request. - The same
context_groupis used for agent contexts/messages throughout that session. - Best when you want strict tenant keys like
workspace:<id>:user:<id>.
signin session
Use this when agent context should follow the currently active signed-in account.
- Set
agent_session_identifier: "signin". context_groupis derived from the active sign-in user ID.- If there is no active sign-in, the session is rejected.
Flow A: static agent session
Flow B: signin agent session
What context_group means
context_group is the partition key for agent runtime state.
It decides which execution contexts/messages are considered part of the same conversation bucket for that session scope.
Practical guidance:
- Use deterministic keys, for example
workspace:<workspaceId>:user:<userId>. - Never use a global/shared value across tenants.
- Keep one format across your app so support and debugging are predictable.
- In
signinmode, Wacht derives this from active sign-in user ID.
Runtime UI model (independent from session type)
Either session type can be used with vanity UI or custom UI hooks.Option 1: Open vanity UI
Option 2: Build custom UI with hooks
Runtime checklist
- Tickets should be short-lived and created only after your own authz checks.
- Scope
agent_idsand session type (static/signin) to your tenancy model. - For
static, enforce a strictcontext_groupformat. - For
signin, ensure an active sign-in exists before ticket use. - Handle expired tickets with a re-issue flow.
- Exchanging a new
agent_accessticket replaces the older active agent session for that browser session.
