> ## Documentation Index
> Fetch the complete documentation index at: https://docs.rallied.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Traceless

> Confirm callers are who they say they are: Traceless triggers MFA push verification across mixed Duo and Microsoft Authenticator stacks in one call.

Traceless is an identity verification orchestrator. When the agent needs to confirm an employee's identity before a sensitive action, Traceless sends an MFA push notification through the employee's existing authenticator (Duo or Microsoft Authenticator), so you don't have to connect each one individually.

<Note>
  Traceless is configured in **Settings → Integrations**.
</Note>

## When to use Traceless

Use Traceless if you want a single identity verification provider that works across an end-user base with mixed MFA tools. Traceless routes each push to the user's existing factor, so you don't need to connect Duo and Microsoft 365 separately just for verification.

If all your clients use the same provider (for example, Microsoft 365 everywhere), you can use that provider's native push directly — see [Identity verification](/agents/identity-verification).

## How to connect

You'll need API credentials from your Traceless admin settings before starting.

<Steps>
  <Step title="Get your Traceless credentials">
    Sign in to [Traceless](https://traceless.io/settings/) as an organization admin. From the admin settings page, copy your **API signing secret** and **Organization UUID**.
  </Step>

  <Step title="Open Integrations">
    In Rallied, go to **Settings → Integrations**.
  </Step>

  <Step title="Connect Traceless">
    Find the Traceless card and click **Connect**. A credentials form appears.
  </Step>

  <Step title="Enter your credentials">
    Fill in:

    * **API Signing Secret** — the signing secret from Traceless admin settings.
    * **Organization UUID** — your Traceless organization identifier.
    * **Default Push Method** — the authenticator app to route pushes to: **Microsoft Authenticator** or **Duo Push**.
  </Step>

  <Step title="Save and confirm">
    Click **Save**. Rallied validates the credentials against the Traceless API. The card shows **Connected** when complete.
  </Step>
</Steps>

## How verification works

When the agent decides an action is sensitive — for example, a password reset or admin permission change — it asks Traceless to verify the requesting employee:

<Steps>
  <Step title="Agent requests verification">
    The agent asks Traceless to challenge the employee using their work email. Traceless finds the right device against your connected MFA system.
  </Step>

  <Step title="Employee receives a push">
    The employee gets a push notification on the configured authenticator app and approves it from their phone.
  </Step>

  <Step title="Rallied polls for the result">
    The backend polls Traceless every few seconds for up to 5 minutes until the verification resolves.
  </Step>

  <Step title="Agent proceeds or stops">
    On **approval**, the agent continues the plan. On **denial**, **timeout**, or **failure**, the agent stops and informs the requester.
  </Step>
</Steps>

## Turn off requester verification

Traceless has two jobs. It verifies requesters before the agent acts on sensitive tickets. It also delivers credentials to employees through one-time secret links. You can turn off verification and keep Traceless for secret links only.

The **Verify requester identity** switch is on the **Traceless** integration detail page (open it from **Settings → Integrations**). It's on by default. You need integration write access to change it.

| Setting | What happens on a sensitive ticket |
| - | - |
| **On** (default) | Traceless sends the requester a verification push. The agent does not act until the requester approves it. |
| **Off** | Traceless sends no verification push. The agent plans the work, and a technician must approve the plan before anything runs. The plan states that the requester's identity was not verified. |

Secret links still go through Traceless when verification is off.

<Warning>
  When verification is off, your technician's plan approval is the only check on sensitive requests like password and MFA resets. Review who requested the change before you approve the plan.
</Warning>

## Push method options

| Method | Authenticator app |
| - | - |
| **Microsoft Authenticator** | Microsoft Authenticator on iOS or Android |
| **Duo Push** | Duo Mobile |

The push method you select applies to every verification Traceless handles for your MSP. To change it later, reconnect Traceless with the new value.

## Outcome notes on tickets

When verification is triggered from a PSA ticket — for example, a new ConnectWise service ticket flagged as sensitive — Rallied posts an internal note on the ticket as soon as the verification resolves so your technicians always see the outcome:

* **Approved** — the agent is now processing the ticket.
* **Denied or failed** — the agent will not process the ticket; it needs human handling.
* **Expired** — the requester did not respond within the timeout window; the agent will not process the ticket.

## Limits and timing

* The verification window is **5 minutes** from the moment the push is sent. After that, the verification expires and the agent does not execute the action.
* The agent's tool execution is paused for the entire client session while a verification is pending. No further actions run until the verification resolves.
* A fresh verification is required for every new sensitive request, even from the same employee.

<Warning>
  If verification fails or expires, the agent never executes the sensitive action — even if a technician already approved the plan. The requester must resubmit to try again.
</Warning>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.