Connector auth: single-tenant, per user, per org, and delegated

Every connector resolves a credential in one of two ways - admin-connected or delegated - and delegated connectors then apply an identity mode. This decides whose account a tool call runs as.

Admin-connected vs delegated

• Admin-connected: an admin authenticates the connector once and every call uses that one credential. Per-request identity headers are ignored.
• Delegated: the caller supplies identity per request via X-Org-Id and (for per-user) X-User-Id, and the gateway acts on their behalf - so one agent key can serve many tenants and users.

Identity modes (delegated connectors)

• Single-tenant (shared): one org-wide credential for every caller.
• Per user: each caller acts as themselves using their own stored token; if they have not connected, the call returns an authorization link.
• Per org: multi-tenant, but each org shares one credential; the gateway resolves it from the X-Org-Id (a key serving many orgs gets each org's own shared account).

How the credential is chosen

• Admin-connected → the connector's one stored credential.
• Delegated + shared → the org credential.
• Delegated + per-user → the X-User-Id's own stored token (or an auth link if missing).
• Delegated + per-org → the X-Org-Id's own shared credential.

A single call can still override the credential by passing a reserved "_identity" argument of "org" or "user"; it is stripped before the request reaches the downstream server and only takes effect where both accounts exist (a per-user or per-org connector). A single-tenant (shared) connector rejects a conflicting override.