The Set up K-Block card on the Overview leads a new organization from empty to its first protected agent call in eight steps. The same eight steps are listed when you create an organization, under "Then, eight steps to a protected agent".
Each step's state is read from the organization's real data through the Cloud API, never stored as a checklist. A step is marked done only when the data shows it, so the guide stays correct when several people set things up, and a step can become not done again (for example, after the only callable tool is disabled).
How the card works
- The card shows "N of 8 done" with a progress bar.
- A done step shows Done. The first step that is not done is the next step and shows a button naming where it leads, for example Open settings. Each step's title links to the page where you do it.
- If the state of a step could not be read, the step shows no state. It is never shown as done.
- When all eight steps are done, the card disappears.
The steps
| # | Step | Done when | Where |
|---|---|---|---|
| 1 | Set the organization principal | The organization has a principal. | Settings |
| 2 | Bind your personal identity | You (the signed-in person) have at least one personal identity that is not revoked. | Your account |
| 3 | Register an MCP server and expose tools | At least one tool is callable: enabled, on an active server, with an authorized binding. | Tools & MCP servers |
| 4 | Activate a policy | At least one policy version in the organization is active. | Policies |
| 5 | Create an agent | At least one agent is active. | Agents |
| 6 | Authorize the agent | At least one agent has an active delegation. | Agents |
| 7 | Create a Gateway API key | At least one agent has a gateway API key that is not revoked. | API keys |
| 8 | Send the first call through the Gateway | The organization has at least one protected action. | Actions |
1. Set the organization principal
The organization principal is the organization's K-Block identity. It signs every delegation, revocation and cancellation. Its private key is generated in a browser and never sent to K-Block Cloud.
What to do: an owner opens Settings, finds Organization principal and selects Generate principal in this browser. Only owners can set the principal; other roles see "Only owners can set the organization principal." Export a key backup afterwards: a key that exists only in one browser is lost with it. See Settings and Identities and KIDs.
2. Bind your personal identity
Approvers sign their decisions with a personal key generated in their own browser. This step looks only at the signed-in person, so each member sees their own state.
What to do: open Your account, find Personal K-Block identity and select Generate and bind. Your e-mail address must be verified first. See Your account.
3. Register an MCP server and expose tools
The Gateway forwards authorized calls to an upstream MCP server. Each exposed tool maps an action and, optionally, an amount.
What to do: on Tools & MCP servers, select Register MCP server, then on the server's page select Discover tools and Expose… for each tool agents may call. A tool a developer exposes is a disabled draft and does not count: an owner or admin must enable it. See Tools and MCP servers.
4. Activate a policy
A policy's rules decide whether each call is allowed, held for approval or denied. Until a version is active, every call is denied.
What to do: on Policies, create a policy (from a template or blank), then an owner or admin activates a version. Any active version in the organization marks this step done, even if no agent uses that policy yet. See Create a policy and Activate, roll out and roll back.
5. Create an agent
An agent is the identity your AI application calls tools under, bound to one policy.
What to do: on Agents, select New agent, choose its policy and select Create agent. Only an active agent counts. See Agents.
6. Authorize the agent
The principal signs a delegation to the Gateway in your browser. It lists the actions the Gateway may execute for the agent.
What to do: an owner or admin who has the principal's key in this browser opens the agent and fills in Authorize this agent, then selects Sign and submit delegation. A delegation counts while it is not revoked, not expired, has no pending revocation and was signed by the current principal. A delegation whose Valid from time is still in the future counts too, although no call can use it yet. See Agents.
7. Create a Gateway API key
The agent presents a gateway API key to the Gateway. The key is shown once.
What to do: an owner, admin or developer selects Create a gateway key on the agent's page (or opens API keys and selects New API key, then chooses the agent). Keep the kind Gateway key, enter a Name, choose the Environment (Live or Test), select Create key, and store the key in your agent's secret store. See API keys.
8. Send the first call through the Gateway
What to do: point the agent's MCP client at the Gateway's MCP endpoint with its gateway key. The step shows the endpoint (the Gateway URL followed by /mcp). When you create a gateway key, the notice that shows the key once also shows the endpoint with a copy button, and the Gateway KID: the identity that signs your receipts. If the dashboard shows no endpoint or no Gateway KID, contact K-Block support. The agent's MCP client sends the key as its bearer token.
Any protected action marks this step done, including a call the policy denied. Open Actions to see what happened. See Your first protected action and TypeScript client.
Things to know
- Steps 6 and 7 look at the first 100 agents. In an organization with more agents, where none of the first 100 matches, these steps show no state instead of "not done".
- Steps 5, 6 and 7 are counted separately. Step 5 counts only active agents, but steps 6 and 7 count any agent. A disabled agent with a delegation and a key can mark steps 6 and 7 done while step 5 is not.
- Step 6 counts a delegation that is not valid yet. A delegation whose Valid from time is in the future marks the step done.
- Step 7 counts every key that is not revoked, including a key that has expired.
- Done does not mean working. The guide checks that each piece exists, not that they fit together: for example, that the agent's policy is the active one, or that its delegation covers your tools' actions. Use Test a call on the agent's page to check a specific call (see Test and simulate).