---
title: "Consumer controls"
description: "The end-user boundary for OIDC sessions, profile, memory, Actions, and receipts."
image: "https://help.agent.mq/og.svg"
---

> Documentation Index
> Fetch the complete documentation index at: https://help.agent.mq/llms.txt
> Use this file to discover all available pages before exploring further.

# Consumer controls

The consumer API runs under `/v1/consumer/applications/{appId}/providers/{providerId}/{command}`. It uses OIDC authorization code flow with PKCE and isolates each person's data inside the application.

## Command families

| Family | Purpose |
| --- | --- |
| `start`, `callback`, `session`, `refresh`, `logout` | Create, inspect, refresh, or revoke the consumer session |
| `action.review`, `action.approve`, `action.reject` | Review and decide an immutable Action |
| `control.profile`, `control.profile.update` | Read or update the signed-in person's profile |
| `control.memory.*` | Query, upsert, delete, or export the person's bounded encrypted memory |
| `control.sessions.*` | List or revoke the person's sessions |
| `control.actions.*` | List, cancel, or read receipts for the person's Actions |

## Security model

- Upstream OAuth tokens are encrypted and never returned to an Agent.
- A caller cannot select another person's ownership ID to cross the boundary.
- Disabling memory blocks reads and writes; known-item deletion remains available.
- Revoking an AgentMQ session also requests upstream token revocation, but does not sign the person out of every browser session at the identity provider.

## See also

- [Prepare, approve, and execute](/approval/human-approval)
- [Connect an OAuth account](/build/oauth-connections)

Source: https://help.agent.mq/approval/consumer-controls/index.mdx