# Ground Control

Ground Control is an operator console for governing and observing AI-assisted work across connected systems. Agents can use the links below to discover the MCP integration and learn how to use its bridge.

- [MCP resource discovery](/.well-known/oauth-protected-resource)
- [MCP bridge documentation](/docs/mcp-bridge)

## Machine-credential origination

A tenant must already exist; an agent cannot create one through the machine-credential enrollment routes. Before the agent starts, a human tenant owner must use a verified-email browser session with the `saas.api_key.create` permission and authentication that is at most five minutes old to `POST /v1/machine-credentials/enrollment-tokens` with `tenant_id`. Hand the returned one-time `enrollment_token` to the agent out of band. Its default lifetime is 24 hours; an issuer may choose an expiry no more than 7 days from issuance. The agent then calls `POST /v1/machine-credentials/enrollments` with the existing `tenant_id`, `enrollment_token`, `display_name`, tenant-wide scopes limited to `mcp:bridge.read`, `mcp:bridge.call`, `worker_facade.claim`, `governed_execution.read`, `governed_execution.write`, and the credential `expires_at`. Redemption creates one credential in the existing tenant and consumes the token; it cannot create a tenant or be reused.