Version: main 🚧

Autonomous Agents

Autonomous Agents run Dynamic Agent tasks without a live user request. A task can fire from an interval, cron schedule, or webhook, then send its prompt to the configured Dynamic Agent and record run history for the UI.

The service is disabled by default. Enabling it installs the caipe-autonomous-agents service and exposes management through the CAIPE UI server-side /api/autonomous proxy. The service itself should remain cluster-internal except for the webhook receiver path.

Runtime flow

Where task management lives

Surface	Who sees it	What it does
Autonomous (main nav)	Any user with ≥1 schedulable or automatable agent	Lists the user's own tasks, grouped by agent; creates, edits, runs and deletes them
Autonomous → Automation	Team admins (and platform admins)	Enables or disables autonomous per agent for the agent's owner team
Admin → Teams & Users → Autonomous	Organization admins	Oversight across all teams and users, with pause/resume
Admin → Teams → team details	Organization admins	Grants a team autonomous eligibility (the precondition for per-agent enablement)

Autonomous controls no longer appear on the Agents page.

Task identifiers

Task IDs are generated by the server as slug(name)-<4 hex> (e.g. daily-report-a3f9). They are globally unique, immutable, and cannot be chosen by the caller — an id supplied to POST /api/v1/tasks is ignored.

Display names are free text and need not be unique: two users, or one user twice, may both have a task called "Daily report". The UI warns on a duplicate name but does not block it.

The generated ID is what appears in the webhook URL (/api/v1/hooks/<task-id>) and in run history, so it is surfaced read-only on the task row and in the edit form.

API callers that previously pinned IDs (seed scripts, IaC) now receive a generated ID instead. Idempotent seeding must match on name via GET /api/v1/tasks rather than assuming a known ID.

Enable Autonomous Agents

The following example assumes a Helm release named caipe and the bundled Dynamic Agents, CAIPE UI, MongoDB, Keycloak, and OpenFGA charts. Replace Secret names and public URLs for your environment.

tags:
  caipe-ui: true
  dynamic-agents: true
  autonomous-agents: true
  keycloak: true

caipe-ui:
  config:
    ENABLE_AUTONOMOUS_AGENTS: "true"
    AUTONOMOUS_AGENTS_URL: "http://caipe-autonomous-agents:8002"

autonomous-agents:
  existingSecret: autonomous-agents-secret
  dynamicAgentsAuth:
    enabled: true
    clientId: caipe-platform
    clientSecretRef:
      name: caipe-platform-secret
      key: OIDC_CLIENT_SECRET
  config:
    MONGODB_DATABASE: caipe
    # Opt in to publishing autonomous task threads into the normal Chat UI.
    CHAT_HISTORY_PUBLISH_ENABLED: "true"
    # Optional overrides. When empty, the subchart defaults to the in-release
    # Services for Dynamic Agents and the legacy supervisor endpoint.
    # DYNAMIC_AGENTS_URL: "http://external-dynamic-agents:8001"
    # SUPERVISOR_URL: "http://external-supervisor-agent:8000"

Create or provide the Secret referenced by autonomous-agents.existingSecret:

kubectl create secret generic autonomous-agents-secret \
  --from-literal=MONGODB_URI='mongodb://user:password@mongodb:27017/caipe?authSource=admin' \
  --from-literal=WEBHOOK_SECRET='<strong random value>'

MONGODB_URI is required. WEBHOOK_SECRET is required before webhook ingress is enabled. Add WEBEX_BOT_TOKEN, WEBEX_WEBHOOK_SECRET, and WEBEX_BOT_PUBLIC_URL to the same Secret when using Webex-triggered tasks.

Enable chat history

CHAT_HISTORY_PUBLISH_ENABLED defaults to "false". With the default setting, tasks, run status, errors, and response previews remain available in the Autonomous tab, but autonomous runs are not written to the normal Chat history and no Thread or Open in chat links are exposed.

Set autonomous-agents.config.CHAT_HISTORY_PUBLISH_ENABLED: "true" to publish one Chat conversation per autonomous task. Autonomous Agents and the CAIPE UI must use the same MongoDB database. After enabling the setting, run an existing task again to create or update its conversation; runs completed while publishing was disabled are not backfilled automatically.

Autonomous Agents must also authenticate to Dynamic Agents. With bundled Keycloak, dynamicAgentsAuth uses the caipe-platform client and defaults its token URL to the release's Keycloak service. The client secret is read directly from caipe-platform-secret; it is not copied into a ConfigMap.

For an external identity provider, set its token endpoint and Secret reference:

autonomous-agents:
  dynamicAgentsAuth:
    enabled: true
    tokenUrl: https://sso.example.com/realms/caipe/protocol/openid-connect/token
    clientId: caipe-platform
    scope: "openid profile email"
    clientSecretRef:
      name: external-platform-client
      key: client-secret

OpenFGA and on-behalf-of runs

Autonomous tasks run as their task owner. In RBAC deployments, Dynamic Agents and CAS need the platform service account to hold can_audit on the organization so CAS can evaluate authorization on behalf of that owner.

Enable the OpenFGA init job's platform-client seed when the bundled Keycloak platform client Secret is available:

openfga:
  enabled: true
  init:
    platformClient:
      enabled: true
      clientId: caipe-platform
      clientSecretRef:
        name: caipe-platform-secret
        key: OIDC_CLIENT_SECRET
      orgObject: organization:caipe

If Keycloak is external, set openfga.init.platformClient.tokenUrl to that realm's token endpoint and point clientSecretRef at a Secret containing the platform client's client secret.

Webhook ingress

Keep the Autonomous Agents service private by default. If external systems need to trigger webhook tasks, expose only /api/v1/hooks:

autonomous-agents:
  ingress:
    enabled: true
    className: nginx
    hosts:
      - host: autonomous-hooks.example.com
        paths:
          - path: /api/v1/hooks
            pathType: Prefix
    tls:
      - hosts:
          - autonomous-hooks.example.com
        secretName: autonomous-hooks-tls

Do not expose / for this service. Task management is intentionally protected by the CAIPE UI proxy, not by the Autonomous Agents service itself.

Important environment variables

Variable	Where set	Purpose
`ENABLE_AUTONOMOUS_AGENTS`	`caipe-ui.config`	Shows the Autonomous UI and enables the BFF proxy.
`AUTONOMOUS_AGENTS_URL`	`caipe-ui.config`	Cluster URL the UI proxy uses to reach the service.
`DYNAMIC_AGENTS_URL`	`autonomous-agents.config`	Runtime endpoint used when a task targets a Dynamic Agent.
`DYNAMIC_AGENTS_OAUTH2_TOKEN_URL`	`autonomous-agents.dynamicAgentsAuth.tokenUrl`	Token endpoint used to mint the service bearer token.
`DYNAMIC_AGENTS_OAUTH2_CLIENT_ID`	`autonomous-agents.dynamicAgentsAuth.clientId`	OAuth client used for service-to-service authentication.
`DYNAMIC_AGENTS_OAUTH2_CLIENT_SECRET`	`autonomous-agents.dynamicAgentsAuth.clientSecretRef`	Secret-backed OAuth client credential.
`DYNAMIC_AGENTS_OAUTH2_SCOPE`	`autonomous-agents.dynamicAgentsAuth.scope`	Scopes requested for the service bearer token.
`MONGODB_URI`	`autonomous-agents.existingSecret` or ExternalSecret	Shared MongoDB connection for tasks and run history.
`MONGODB_DATABASE`	`autonomous-agents.config`	MongoDB database name, normally `caipe`.
`CHAT_HISTORY_PUBLISH_ENABLED`	`autonomous-agents.config`	Opts in to publishing autonomous task conversations into the normal Chat history. Defaults to `"false"`.
`WEBHOOK_SECRET`	`autonomous-agents.existingSecret` or ExternalSecret	HMAC fallback secret for incoming webhooks.
`WEBEX_BOT_TOKEN`	`autonomous-agents.existingSecret` or ExternalSecret	Enables Webex inbound events.
`WEBEX_WEBHOOK_SECRET`	`autonomous-agents.existingSecret` or ExternalSecret	Verifies Webex webhook signatures.
`WEBEX_BOT_PUBLIC_URL`	`autonomous-agents.existingSecret` or ExternalSecret	Public base URL used when registering Webex webhooks.

Operational notes

Keep replicaCount at 1; the scheduler has no leader election, so multiple replicas can double-fire interval or cron tasks.
The CAIPE UI proxy enforces who may manage tasks. Do not bypass it for task management APIs. The proxy is per-user by design; the Autonomous Agents service applies per-task ownership using the identity headers the proxy injects.
Run history is stored in MongoDB. Conversation publishing is disabled by default and should be enabled only after reviewing storage and tenant visibility requirements.

Runtime flow​

Where task management lives​

Task identifiers​

Enable Autonomous Agents​

Enable chat history​

OpenFGA and on-behalf-of runs​

Webhook ingress​

Important environment variables​

Operational notes​