Enable tools to use member credentials through Microsoft Teams and the Orchestrate Agent API

Requested enhancement

Enable tools to use member credentials when an agent is accessed through external channels. IBM watsonx Orchestrate should identify the requesting user and run tool actions on behalf of that user, using the credentials and permissions associated with the user's account in the third-party application.

Target channels

• Microsoft Teams channel

• Custom applications that use the Orchestrate Agent API

Expected behavior

• Securely map the authenticated user from the external channel to the corresponding watsonx Orchestrate user.

• Use that user's member credentials, or generate a user-scoped access token and securely pass it to the downstream tool.

• Ensure that User A and User B use their own credentials and permissions, even when using the same agent and tool.

• Prompt the user to connect or reauthenticate if their credentials are missing or expired, and then resume the operation.

• Do not automatically fall back to team credentials.

• Record the user, channel, tool, target application, and result in audit logs without exposing credentials.

Value to users

This capability would preserve user-level permissions, least-privilege access, and auditability when agents are used outside the watsonx Orchestrate UI. It would also eliminate the need to share team credentials or build a separate credential-management mechanism, while allowing users to continue working through Microsoft Teams or an existing custom portal.