> For the complete documentation index, see [llms.txt](https://www.cakewalk.security/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.cakewalk.security/docs/readme.md).

# Cakewalk Documentation

Cakewalk governs access for the people in your company and for the AI agents working alongside them. Human Access automates the access lifecycle for your people. Agent Access decides what an agent is allowed to do in your apps. Both draw on one directory and one policy model, and these docs cover all three.

<button type="button" class="button primary" data-action="ask" data-icon="gitbook-assistant">What do you need?</button>

<button type="button" class="button secondary" data-action="ask" data-query="How do I onboard or offboard someone?" data-icon="user-plus">Onboard & offboard</button><button type="button" class="button secondary" data-action="ask" data-query="How do I see who has access to what?" data-icon="eye">Who has access</button><a href="https://www.cakewalk.security/docs/human-access/how-to-guides/auto-provisioning" class="button secondary" data-icon="wand-magic-sparkles">Auto provisioning</a><a href="https://www.cakewalk.security/docs/ai-agent-access/introduction/get-going-with-agent-access/employee-setup" class="button secondary" data-icon="robot">Connect an agent</a>

<table data-view="cards"><thead><tr><th></th><th></th><th></th><th data-hidden data-card-target data-type="content-ref"></th></tr></thead><tbody><tr><td><h4><i class="fa-diagram-project" style="color:$primary;">:diagram-project:</i></h4></td><td><strong>Platform Overview</strong></td><td>What Cakewalk governs, how the two modules share identities and apps, and where trust sits.</td><td><a href="/spaces/SFNDEJ0ftmjxCl4CyGz8/pages/frWQT8ZvbqhL3ByJVdQg">/spaces/SFNDEJ0ftmjxCl4CyGz8/pages/frWQT8ZvbqhL3ByJVdQg</a></td></tr><tr><td><h4><i class="fa-users" style="color:$primary;">:users:</i></h4></td><td><strong>Human Access</strong></td><td>Automate the access lifecycle for your people: onboarding, provisioning, requests, reviews and offboarding.</td><td><a href="/spaces/IxyG113O2Kw9MgVYjSqU/pages/NRd5ck0Ai3c5B7EFPCzY">/spaces/IxyG113O2Kw9MgVYjSqU/pages/NRd5ck0Ai3c5B7EFPCzY</a></td></tr><tr><td><h4><i class="fa-robot" style="color:$primary;">:robot:</i></h4></td><td><strong>Agent Access</strong></td><td>Govern what AI agents can do in your company's apps, with every tool call evaluated against your policies.</td><td><a href="/spaces/Lsu6H9pPkuliZLs6HJSs">/spaces/Lsu6H9pPkuliZLs6HJSs</a></td></tr></tbody></table>

## 🧩 How the two modules fit together

Before you pick a path, it helps to know how the two halves relate. People and agents draw on the same identities, the same apps and the same policy model. An agent's access is its person's access, which is why joining, moving and leaving change both at once.

<a href="/spaces/SFNDEJ0ftmjxCl4CyGz8/pages/RB5EBViLYTSD0UPmjjyy" class="button primary" data-icon="diagram-project">How they connect</a> <a href="/spaces/SFNDEJ0ftmjxCl4CyGz8/pages/Xd8nSLexWYKuKYDQoAgj" class="button secondary" data-icon="arrows-rotate">User lifecycle</a>

## 🧭 Find your starting point

Now to the practical part. What you do first depends on your role and on the module your company runs.

{% tabs %}
{% tab title="I administer Cakewalk" %}

### 👥 Human Access

{% stepper %}
{% step %}

#### Connect your identity source

Your HRIS or identity provider. Cakewalk imports your people with their team, title and manager.
{% endstep %}

{% step %}

#### Import and govern your apps

Bring in the apps your company already uses and assign an owner to each one.
{% endstep %}

{% step %}

#### Set policies and run a review

Policies decide who gets what automatically. A review confirms the picture is still true.
{% endstep %}
{% endstepper %}

The identity source is the spine. Everything downstream keys off it, so connect it before anything else.

<a href="/spaces/IxyG113O2Kw9MgVYjSqU/pages/LLBRkaAMnHi8TVFZDhXZ" class="button primary" data-icon="rocket-launch">Human Access setup</a> <a href="https://www.cakewalk.security/docs/human-access/introduction/quick-starts-by-role/cakewalk-for-app-owners" class="button secondary" data-icon="user-shield">App Owners</a>

### 🤖 Agent Access

{% stepper %}
{% step %}

#### Set up your company

Organization name, domain and the provider your team signs in with.
{% endstep %}

{% step %}

#### Import your team

Sync from your HRIS or identity provider, or add people by hand.
{% endstep %}

{% step %}

#### Build your catalogs

Choose the Connections and Agents your company makes available.
{% endstep %}
{% endstepper %}

The default posture allows Read, escalates Write and denies Destructive and External. Tune it before you widen access, not after.

<a href="https://www.cakewalk.security/docs/ai-agent-access/introduction/get-going-with-agent-access/admin-setup" class="button primary" data-icon="rocket-launch">Agent Access setup</a> <a href="https://www.cakewalk.security/docs/ai-agent-access/concepts/policies" class="button secondary" data-icon="shield-halved">Policies</a>
{% endtab %}

{% tab title="I use Cakewalk" %}

### 👥 Human Access

{% stepper %}
{% step %}

#### Find the app you need

Browse what your company already runs, from Slack or the web.
{% endstep %}

{% step %}

#### Request access

Say what you need it for. No ticket, no waiting on IT to notice.
{% endstep %}

{% step %}

#### Track it and tidy up

Follow the request through, and drop access you no longer use.
{% endstep %}
{% endstepper %}

Requests route to your manager, so that field has to be set on your profile before anything can be approved.

<a href="https://www.cakewalk.security/docs/human-access/introduction/quick-starts-by-role/cakewalk-for-employees" class="button primary" data-icon="rocket-launch">Employee quick start</a>

### 🤖 Agent Access

{% stepper %}
{% step %}

#### Connect the apps you use

Open **My Connections** and authorize each app your agent will need.
{% endstep %}

{% step %}

#### Set up your agent

Open **My Agents**, pick yours and follow the install method it shows.
{% endstep %}

{% step %}

#### Answer approval prompts

Sensitive actions pause and ask you before they run.
{% endstep %}
{% endstepper %}

Your agent inherits exactly your access and nothing more. Connections are per person, so nobody else's apps come with it.

<a href="https://www.cakewalk.security/docs/ai-agent-access/introduction/get-going-with-agent-access/employee-setup" class="button primary" data-icon="rocket-launch">Employee setup</a>
{% endtab %}
{% endtabs %}

## 🔁 Follow the access lifecycle

Setup done, the work settles into a cycle. Access moves through the same four stages whether it belongs to a person or an agent.

{% tabs %}
{% tab title="Connect" %}
Bring your systems in, so Cakewalk knows who works here and what they use.

**Human Access**

* [Identity sources](https://www.cakewalk.security/docs/platform-overview/connections-and-integrations/identity-sources): sync people from your HRIS or identity provider
* [Apps](https://www.cakewalk.security/docs/human-access/how-to-guides/apps): discover and import what your company already runs

**Agent Access**

* [Connections](https://www.cakewalk.security/docs/ai-agent-access/how-to-guides/connections): the apps an agent is allowed to reach through
* [Agents](https://www.cakewalk.security/docs/ai-agent-access/how-to-guides/agents): the agent platforms your company approves
  {% endtab %}

{% tab title="Grant" %}
Get access to the right people and agents, without a ticket queue.

**Human Access**

* [Auto provisioning](https://www.cakewalk.security/docs/human-access/how-to-guides/auto-provisioning) Agent Cake creates the account for you
* [Requests](https://www.cakewalk.security/docs/human-access/how-to-guides/requests): self serve, routed to the right approver
* [Users and groups](https://www.cakewalk.security/docs/human-access/how-to-guides/users-and-groups): what a group carries by default

**Agent Access**

* An agent holds nothing of its own. It inherits the Connections its person already authorized, which is why [Connections](https://www.cakewalk.security/docs/ai-agent-access/how-to-guides/connections) are the grant.
  {% endtab %}

{% tab title="Govern" %}
Decide what is allowed while it happens, not afterwards.

**Human Access**

* [Policies](https://www.cakewalk.security/docs/human-access/how-to-guides/policies): who gets what automatically, and what needs a human

**Agent Access**

* [Policies](https://www.cakewalk.security/docs/ai-agent-access/concepts/policies): evaluated per tool call, not per session
* [The tool call lifecycle](https://www.cakewalk.security/docs/ai-agent-access/concepts/the-tool-call-lifecycle): where the decision happens and how approval reaches a person

The default posture allows Read, escalates Write and denies Destructive and External.
{% endtab %}

{% tab title="Review" %}
Confirm the picture is still true, and prove it to an auditor.

**Human Access**

* [Access reviews](https://www.cakewalk.security/docs/human-access/how-to-guides/access-reviews): campaigns that ask owners to confirm or revoke
* [Request log](https://www.cakewalk.security/docs/human-access/how-to-guides/requests): every request and the task trail behind it, kept for auditability

**Agent Access**

* [Agent activity](https://www.cakewalk.security/docs/ai-agent-access/how-to-guides/agents/agent-activity): what each agent has been doing, per tool call
  {% endtab %}
  {% endtabs %}

## 📖 Go deeper

When the how to guides are not enough, these explain the model underneath and how to drive Cakewalk from your own code.

{% tabs %}
{% tab title="Core concepts" %}
How the platform works underneath, for when the how to guides are not enough.

**Human Access**

* [Access governance pillars](https://www.cakewalk.security/docs/human-access/concepts/access-governance-pillars): the model the whole module is built on
* [Roles and permissions](https://www.cakewalk.security/docs/human-access/concepts/cakewalk-roles-and-permissions): who can do what inside Cakewalk
* [Data models](https://www.cakewalk.security/docs/human-access/concepts/data-models): users, apps, policies, requests and tasks

**Agent Access**

* [The three actors](https://www.cakewalk.security/docs/ai-agent-access/concepts/the-three-actors): the person, the agent and the app, and who holds what
* [The MCP Gateway](https://www.cakewalk.security/docs/ai-agent-access/concepts/the-mcp-gateway): the proxy every tool call passes through
* [The tool call lifecycle](https://www.cakewalk.security/docs/ai-agent-access/concepts/the-tool-call-lifecycle): where a call is evaluated and how approval reaches a person
* [Trust and security](https://www.cakewalk.security/docs/ai-agent-access/concepts/trust-and-security): what the gateway holds and what it never returns
  {% endtab %}

{% tab title="APIs and webhooks" %}
Call Cakewalk from your own code. This is a Human Access surface. Agent Access has no public API.

* [Getting started](https://www.cakewalk.security/docs/human-access/open-api-and-mcp/getting-started): your first call
* [Authentication](https://www.cakewalk.security/docs/human-access/open-api-and-mcp/authentication): how to get a token and use it
* [API reference](https://www.cakewalk.security/docs/human-access/open-api-and-mcp/api-reference): users, applications, requests, policies and access reviews
* [Connect an MCP client](https://www.cakewalk.security/docs/human-access/open-api-and-mcp/mcp/connect-an-mcp-client): point your own agent at Cakewalk's data
* [Webhooks](https://www.cakewalk.security/docs/human-access/open-api-and-mcp/webhooks): get told when something changes, instead of polling

Rate limits and pagination are documented alongside the reference.
{% endtab %}
{% endtabs %}

## 🔌 Integrations

None of it matters until Cakewalk is connected to the systems you already run. There are three families.

<table data-view="cards"><thead><tr><th></th><th></th><th></th><th data-hidden data-card-target data-type="content-ref"></th></tr></thead><tbody><tr><td><h4><i class="fa-id-badge" style="color:$primary;">:id-badge:</i></h4></td><td><strong>Identity sources</strong></td><td>Sync your people from the HRIS or identity provider you already run. Over 20 supported, including Personio, BambooHR, Entra ID, Okta and Workday.</td><td><a href="/spaces/SFNDEJ0ftmjxCl4CyGz8/pages/0ITKDMUUInoGAZjAfBwW">/spaces/SFNDEJ0ftmjxCl4CyGz8/pages/0ITKDMUUInoGAZjAfBwW</a></td></tr><tr><td><h4><i class="fa-wand-magic-sparkles" style="color:$primary;">:wand-magic-sparkles:</i></h4></td><td><strong>Agent Cake and Access Sync</strong></td><td>Per app guides for provisioning, deprovisioning and reading back who holds what. Check coverage before you configure.</td><td><a href="https://www.cakewalk.security/docs/human-access/connections-and-integrations/integration-guides">https://www.cakewalk.security/docs/human-access/connections-and-integrations/integration-guides</a></td></tr><tr><td><h4><i class="fa-robot" style="color:$primary;">:robot:</i></h4></td><td><strong>Agent platforms and Connections</strong></td><td>The agent runtimes your company approves, and the third party apps those agents reach through the MCP Gateway.</td><td><a href="https://www.cakewalk.security/docs/ai-agent-access/connections-and-integrations">https://www.cakewalk.security/docs/ai-agent-access/connections-and-integrations</a></td></tr></tbody></table>

## 🛟 Running into something?

Finally, the problems people actually hit most often.

{% hint style="warning" icon="life-ring" %}

<details>

<summary>Agent Cake cannot sign in because the account needs MFA</summary>

This is the most common reason a provisioning run stops.

Agent Cake generates TOTP codes itself from a shared secret. It cannot approve a push notification, a phone prompt or a hardware key, so the account it signs in with has to offer an authenticator app as a verification method.

Paste the TOTP setup code into the MFA field during the Agent Cake configuration step for that app. Where an app signs in through Google there can be two separate secrets, one protecting the Google sign in and one for the app's own two factor, and they are not interchangeable.

See [Multi-Factor Authentication](https://www.cakewalk.security/docs/human-access/how-to-guides/auto-provisioning/how-it-works/multi-factor-authentication).

</details>

<details>

<summary>A provisioning run failed on permissions</summary>

The service account needs rights in the target app, not just in Cakewalk. Deprovisioning usually needs more than provisioning does, so a run can create accounts happily and then fail when it tries to remove one.

Check that the service account holds admin rights in that app before assuming the integration is broken.

See [Set up Service Accounts](https://www.cakewalk.security/docs/human-access/how-to-guides/auto-provisioning/how-it-works/set-up-service-accounts).

</details>

<details>

<summary>My agent connects but its action was denied</summary>

Policies are evaluated per tool call, and the default posture allows Read, escalates Write and denies Destructive and External. A denial usually means the action type, not the connection.

Each call is recorded with the Policy that decided it, and Agent activity is where to look first.

See [Policies](https://www.cakewalk.security/docs/ai-agent-access/concepts/policies) and [Agent activity](https://www.cakewalk.security/docs/ai-agent-access/how-to-guides/agents/agent-activity).

</details>

<button type="button" class="button primary" data-action="ask" data-icon="gitbook-assistant">Explain what's happening...</button>
{% endhint %}

Need a hand? Email <service@getcakewalk.io>.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://www.cakewalk.security/docs/readme.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.