Connect IAM.Agent to Speech resources for a limited time

Status and access requirements

Staging candidate, not a production release. An isolated synthetic account was used to verify normal IAM.Identity SSO, separate consent for read/write access lasting at most 15 minutes, all seven resource operations, short access refresh and explicit disconnection. Refresh did not extend the original consent expiry; another Core user in the same tenant could not access the resource. After disconnection, status became revoked, the access key was inactive and further reads were denied. Upload used an existing synthetic IAM.Voice WAV, never microphone audio. Accepted audio does not establish completed analysis; this release did not update production Speech.

You need a configured IAM.Core MCP connection in IAM.Agent, an operator-allowed Core tenant and normal IAM.Identity sign-in for your own Speech user. A Speech company is a workspace. Consent does not raise your role, add processing minutes or open another company. Never put tokens or passwords in an agent prompt.

Review and confirm the connection

Ask IAM.Agent to call speech.connection_start with a short single-line reason. Request write: true for adding dialogues and audio; omit write permission for reading. Writes also require the Core user’s current speech:write permission. Review the exact arguments in the normal MCP approval.
Open the returned verification_url. When sign-in is required, select Sign in with IAM.Identity / Войти через IAM.Identity and complete normal sign-in.
On Connect IAM.Agent to Speech, review IAM.Core, Core tenant, Core user, Speech company / user, Requested permissions, Reason and Request expires. The recipient must match your task and account. The link lasts five minutes and grants no resource access by itself.
If you agree with the exact recipient and permissions, scroll below the table, check I authorize this exact Core user and these Speech permissions for up to 15 minutes. and select Connect with IAM.Identity. This is a separate access decision; ordinary Speech sign-in does not replace it. If you disagree, close the page without checking the box.
Complete a new normal IAM.Identity sign-in that confirms the original account. Matching email addresses never merge users or select a company.
Call speech.connection_status in IAM.Agent. A successfully completed connection should return connected with your company, user, permissions and expiry. not_connected permits no reading; creating a link is not a successful connection.

**Review the recipient and permissions before separate consent; the form continues below the visible table.**
2026-10-16 · Historical isolated synthetic staging consent form before approval; upper table without secrets or customer data. This frame alone does not establish connection; the live R5 lifecycle was checked separately.

The capture shows the upper part of the actual form in an isolated synthetic staging profile before consent. The checkbox and button are below the table. The displayed identifiers are educational examples, not values for your connection.

Use resources

After a successful connection, the available operations are speech.dialogues_list, speech.dialogue_get, speech.dialogue_segments, speech.dialogue_metrics and speech.dialogue_activity. Separately approved writes are speech.dialogue_create and speech.dialogue_upload; creating a dialogue does not automatically upload audio.

An upload needs your dialogue UUID, a safe filename, MIME type, audio up to 8 MiB and a reason. Approve that exact submission in IAM.Agent. An accepted file or run is not completed analysis: check the actual status and result. Normal company permissions, supported formats and processing limits still apply.

Disconnect and restore access

Open Open my connections, find the exact connection, enter Reason for disconnecting and select Disconnect this connection. Alternatively, explicitly approve speech.connection_disconnect with a reason in IAM.Agent. Disconnection revokes agent access but does not stop audio processing already accepted or establish global Identity logout.

State	Next action
Link expired before consent	Check `speech.connection_status`. Do not resubmit the old link; prepare a new request and separately review its new consent.
Connection expired	Consent lasts at most 15 minutes from approval. Short renewed access sessions do not extend it. Disconnect the old record and create a new request with new consent.
`unknown` or a mutation response was lost	Never repeat the mutation automatically. Read connection inventory, disconnect the exact uncertain record, then begin a new request.
`401` / refresh refused	Use normal sign-in or a new connection as indicated by its state. A password, another user’s token or a longer local JWT cannot replace consent.
`403` / no write permission	Check the recipient, selected permissions, current role and Core permissions. Consent never bypasses company restrictions.

**Disconnected connection: revoked for the exact Core recipient.**
2026-10-16 · Actual Speech staging, isolated synthetic QA profile after exactly-once Core MCP disconnection. Seven prior operations and refresh were checked separately. No customer data, tokens or microphone recording; does not establish completed audio processing or a production release.

The screenshot shows the exact synthetic staging connection after speech.connection_disconnect. Read revoked for the correct recipient; the time shown is the former expiry, not an extension or renewed authorization. The historical second record is also revoked. No personal or customer data is shown.

Refresh connections only reads status. Closing the form, an expired link and reloading the page do not approve access or automatically repeat a write.