← Glean-ia-acs · Day 50 of 56
Level 500 — Pro · agents & governance30 minNIST MAP

Agent Run-Modes: On Glean, via API, or as MCP

Three places an agent can live, one set of controls

You'll be able to

Read first

Day 1 Lab

  1. List one agent task you want — e.g., "summarize this week's tickets for my team."
  2. Place it in each run-mode in turn: built and run on Glean; called from your own service via the API; exposed to a third-party host over MCP.
  3. For each, name where execution happens and where the trust boundary sits (who holds the token, who sees the data).
  4. Pick the run-mode whose boundary you can actually govern, and write one sentence saying why.

Working Example: The Three Run-Modes Side by Side

Glean describes agents that can be built and run on its platform, invoked from your own code through the API, or surfaced to external hosts over MCP. The graph and the permission model are the same in all three; what changes is where the agent executes and who holds the trust boundary. Verified against developer_platform.

RUN-MODE            EXECUTES            TRUST BOUNDARY              GOVERN WHAT
─────────────────────────────────────────────────────────────────────────────
Run on Glean        Glean platform      inside Glean's tenancy      agent config,
  (agent builder)                       (your instance)             permissions

Call via API        your service        your code <-> Glean API     the token, your
  (typed clients)                       (you hold the token)        service's logs

Expose as MCP       external host        host <-> Glean MCP server   which host, which
  (MCP server)      (Claude, Cursor…)   (host acts as the user)     tools, audit
─────────────────────────────────────────────────────────────────────────────
Same enterprise graph. Same permissions-aware retrieval. Different blast radius.

Choosing a run-mode is a MAP exercise: before any code, make explicit where the agent runs, what token it carries, and who can see results. The mode you can audit is the mode you should pick. Verified against developer_platform.

Check for understanding

For each run-mode, name where the agent executes and where the trust boundary sits.

Check yourself

Pick an answer — you'll see if it's right and why.

1. Glean describes three agent run-modes. Which list matches them?

2. When a host connects to Glean's MCP server with a scoped token, what happens to access?

3. In a guarded multi-tool agent loop, what is the job of the pre-action gate?

4. Across CrewAI, Google ADK, LangGraph, and the OpenAI Agents SDK, what does every Glean tool have in common?

5. Which statement about this curriculum is accurate?

Pass threshold 80% · week 8 quiz

In 10 seconds

“An agent can run inside Glean, be called from your code via API, or be exposed to other hosts over MCP. Same graph, same permissions — three different trust boundaries you must map before you build.”

Next · Week 8 Day 2
The MCP Endpoint: Connect Glean as an MCP Server
← W07D07all lessonsW08D02 →