Teams

Teams let you control who can access which MCP servers and Agent Personas. Instead of managing access user by user, you map your existing SSO groups to teams in the AI Gateway — and access is granted automatically when people log in.

Quick Start: What do you want to do?

I want to...	Jump to
Understand how teams work	How It Works
Create my first team	Creating a Team
Control which MCP servers a team can use	Assigning MCP Servers
Control which Agent Personas a team can use	Assigning Agent Personas
Set up my IdP to send group claims	Setting Up Your Identity Provider

---

How It Works

There are three simple ideas behind teams:

1. Teams map to your SSO groups. When you create a team, you enter the SSO group names from your identity provider (Microsoft Entra, Google Workspace, Okta, etc.). When a user logs in, the gateway checks their group memberships and automatically puts them in the right teams.

2. You assign resources to teams. Each team gets access to specific MCP servers and Agent Personas. A user in the "Engineering" team sees only the MCP servers and personas assigned to Engineering.

3. Unassigned resources are public. If an MCP server or Agent Persona has no teams assigned, every authenticated user can see and use it. You only need teams for resources you want to restrict.

What does this look like in practice?

What you have	Who sees it
An MCP server with no teams assigned	Everyone
An MCP server assigned to Engineering	Only Engineering team members
An MCP server assigned to Engineering and Design	Engineering or Design team members
An Agent Persona assigned to Security	Only Security team members

Admins always see everything. Users with Super Admin, Tenant Admin, Platform Operator, Security Admin, or Network Admin roles bypass team restrictions entirely.

---

Creating a Team

1. Go to Access → Teams in the sidebar.
2. Click Create Team.

A dialog opens with three fields:

Field	Required	What to enter
Team Name	Yes	A clear name — e.g., "Engineering", "Sales", "Security Ops"
Description	No	What this team is for (helps others understand its purpose)
SSO Groups	Yes	The exact group name(s) from your identity provider. Type a name and press Enter to add it. You can add multiple groups — users matching any of them join this team.

Click Create. The team is live immediately.

Where do I find my SSO group names?

The group name you enter must match exactly what your identity provider sends in the login token. Here's where to look:

Identity Provider	Where to find group names
Microsoft Entra ID	Azure Portal → Entra ID → Groups → copy the group's Display Name or Object ID
Google Workspace	Google Admin Console → Groups → use the group's email address (e.g., engineering@company.com)
Okta	Okta Admin Console → Directory → Groups → use the Group Name

If you're unsure, ask your IT team which group claim value your IdP sends. See the IdP setup guides for detailed configuration steps.

---

Assigning MCP Servers

Once a team exists, you decide which MCP servers its members can access. There are two ways to do this:

From the team

1. Go to Access → Teams.
2. Click the team name.
3. Go to the MCP Servers tab.
4. Click Assign Servers.
5. Select the MCP servers this team should access.
6. Click Save.

From the MCP server

1. Go to MCP Registry.
2. Click the MCP server.
3. Go to Settings → Access Control.
4. Select the teams that should have access.
5. Click Save.

Both methods do the same thing — pick whichever feels more natural for what you're doing.

---

Assigning Agent Personas

When creating a persona

In the Create Agent Persona wizard (Step 1: Basic Information), there's a Teams dropdown. Select the teams that should have access. If you leave it empty, the persona is available to everyone.

From the team

1. Go to Access → Teams.
2. Click the team name.
3. Go to the Agent Personas tab.
4. Click Assign Personas.
5. Select the personas this team should access.
6. Click Save.

tip

When a persona is assigned to multiple teams, only MCP servers that all those teams can access are available for tool selection. This prevents a persona from exposing tools that one of its teams shouldn't see. Public MCP servers (no team assignment) are always available.

---

Managing Teams

Editing a team

1. Go to Access → Teams.
2. Click the team name.
3. Click Edit (pencil icon).
4. Change the name, description, or SSO group mappings.
5. Click Save.

Viewing members

Team membership is dynamic — it's determined at login time based on IdP groups. To see who's in a team:

1. Go to Access → Teams.
2. Click the team name.
3. The SSO Mappings tab shows which SSO groups are linked to this team.

When a user's IdP group membership changes (e.g., someone joins the Engineering group in Entra ID), their AI Gateway team membership updates automatically on their next login.

Deleting a team

1. Go to Access → Teams.
2. Click the team name.
3. Click Delete and confirm.

When a team is deleted:

• Members lose access to resources that were restricted to that team.
• MCP servers that were only assigned to the deleted team become public again (visible to everyone).
• The team is removed from any Agent Personas it was assigned to.

---

Real-World Examples

Example 1: "Only engineers should access our DevOps tools"

Setting	Value
Team Name	Engineering
SSO Groups	engineering@company.com
Assigned MCP Servers	GitLab, Jira, PagerDuty, Datadog
Assigned Personas	DevOps Assistant

Engineers log in, the gateway sees they're in the engineering@company.com group, and they automatically get access to the DevOps tools and the DevOps Assistant persona. Sales team members don't see any of these.

Example 2: "Sales and marketing need their own CRM tools"

Setting	Value
Team Name	Revenue
SSO Groups	sales@company.com, marketing@company.com
Assigned MCP Servers	Salesforce, HubSpot
Assigned Personas	CRM Assistant

Users in either the sales or marketing SSO group get access. One team, multiple SSO groups.

Example 3: "Security tools should only be available to the InfoSec team"

Setting	Value
Team Name	Security Ops
SSO Groups	infosec@company.com
Assigned MCP Servers	Snyk, Splunk, CrowdStrike
Assigned Personas	Security Analyst

Only InfoSec members see these tools. Even other engineering team members can't access them.

Example 4: "A cross-functional project team needs shared access"

Setting	Value
Team Name	Project Alpha
SSO Groups	project-alpha@company.com
Assigned MCP Servers	Jira, Confluence, Slack
Assigned Personas	Project Alpha Agent

Create a temporary group in your IdP for the project, map it to a team, and assign the relevant resources. When the project ends, delete the team.

---

Setting Up Your Identity Provider

For teams to work, your identity provider needs to send group claims in the login token. Follow the guide for your provider:

Provider	Guide
Microsoft Entra ID (Azure AD)	Configure Entra Group Claims →
Google Workspace	Configure Google Workspace Group Claims →
Okta	Coming soon

If your provider isn't listed, the general requirement is: configure your IdP to include a groups claim (or equivalent) in the SAML assertion or OIDC token. Your IT team can usually set this up in a few minutes.

---

Tips

• Start with your org chart. Create teams that match your existing departments or project groups. You probably already have SSO groups for these.
• Keep shared tools public. If everyone in the company needs access to an MCP server (like Slack or Confluence), don't assign it to any team — it stays accessible to all.
• Use multiple SSO groups per team. You can map several IdP groups to one team. Useful when your org has fine-grained groups but you want broader access in the AI Gateway.
• Membership is automatic. You don't need to manually add or remove users. When IT adds someone to the SSO group, they join the team on their next login.
• Test with a non-admin account. Admins bypass all team restrictions, so team-based access won't be visible when you're logged in as an admin. Use a regular user account to verify restrictions work as expected.