# Use Resources from Agents

> Bind logical Agent needs to fixed or scoped capabilities and verify the resolved Resource on a Run.

## Before you begin {#before-you-begin}

The Resource must be enabled and expose every capability the Agent expects. The Agent package should declare a logical binding name such as `model`, `github`, or `orders`; that name is part of the Agent contract. Choose whether every invocation uses one fixed Resource or whether Constal should resolve a tenant, customer, or principal-specific Resource at the request boundary. For Models, the Agent binds the logical Model—not its underlying Gateway—and the Model can independently use a [fixed or scoped Gateway](/docs/resources/gateways-and-models.md#fixed-and-scoped-gateways).

## Steps {#steps}

1. In the Agent definition, declare the logical Resource need and the capabilities the Agent is allowed to call.
2. For a fixed binding, assign the exact Resource CRN in the Agent package. This is appropriate when every Run should use the same configured capability.
3. For a scoped binding, assign a binding key and configure its tenant default plus any customer or principal overrides. This is appropriate for shared Agents serving many downstream customers.
4. Deploy the Agent and open its detail page.
5. Follow each Resource link to confirm its status, authentication relationship, settings, and access Policy.
6. Start a controlled Run and exercise one low-risk capability before enabling production traffic.

The Agent calls the logical binding, while Constal resolves and authorizes the exact Resource. Credential material is injected only at the protected invocation boundary; Agent code receives results, not reusable secrets.

## Verify {#verify}

Open the Run and inspect **Resource bindings**. Each binding should show the exact CRN accepted for that Run. Confirm that a scoped invocation resolves the expected tenant, customer, or principal target, and that an unauthorized principal is denied before the external action runs. Existing Runs keep their accepted binding snapshot even when defaults change later.

## Next steps {#next-steps}

Use [Operate Agents](/docs/agents/operate.md) to compare current and pinned bindings, [Run operations](/docs/runs/operate.md) to inspect durable execution, or [Credential lifecycle](/docs/credentials/lifecycle) to rotate authentication without changing Agent code.