feat(ui): add a can-delegate toggle to the agent form for MCP OBO

An agent can only act on behalf of a consenting user when its
object-permission carries mcp_can_delegate, but there was no way to set it
from the dashboard. This adds a "Can act on behalf of users (delegation)"
switch to the agent create form (writing object_permission.mcp_can_delegate,
which the existing agent-create path already persists) and surfaces it in
the agent view. No backend change.

Part of LIT-4448.

ui/litellm-dashboard/src/app/(dashboard)/agents/_components/add_agent_form.tsx

@@ -265,14 +265,19 @@ const AddAgentForm: React.FC<AddAgentFormProps> = ({ visible, onClose, accessTok
       const mcpToolPermissions = values.mcp_tool_permissions || {};
       const entitlementModels = values.entitlement_models || [];
       const entitlementAgents = values.entitlement_agents || [];
+      const canDelegate = values.mcp_can_delegate === true;
       const hasObjectPermission =
         mcpServersAndGroups?.servers?.length > 0 ||
         mcpServersAndGroups?.accessGroups?.length > 0 ||
         Object.keys(mcpToolPermissions).length > 0 ||
         entitlementModels.length > 0 ||
-        entitlementAgents.length > 0;
+        entitlementAgents.length > 0 ||
+        canDelegate;
       if (hasObjectPermission) {
         agentData.object_permission = {};
+        if (canDelegate) {
+          agentData.object_permission.mcp_can_delegate = true;
+        }
         if (mcpServersAndGroups?.servers?.length > 0) {
           agentData.object_permission.mcp_servers = mcpServersAndGroups.servers;
         }
@@ -467,6 +472,22 @@ const AddAgentForm: React.FC<AddAgentFormProps> = ({ visible, onClose, accessTok
           </div>
         )}
       </Form.Item>
+      <Form.Item
+        label={
+          <span>
+            Can act on behalf of users (delegation)
+            <InfoCircleOutlined
+              title="Allow this agent to make MCP tool calls on behalf of a user who has consented. The call is limited to the intersection of the agent's and the user's access."
+              style={{ marginLeft: "4px" }}
+            />
+          </span>
+        }
+        name="mcp_can_delegate"
+        valuePropName="checked"
+        initialValue={false}
+      >
+        <Switch />
+      </Form.Item>
     </div>
   );
 

ui/litellm-dashboard/src/app/(dashboard)/agents/_components/agent_info.tsx

@@ -285,11 +285,15 @@ const AgentInfoView: React.FC<AgentInfoViewProps> = ({ agentId, onClose, accessT
             {agent.object_permission &&
               (agent.object_permission.mcp_servers?.length ||
                 agent.object_permission.mcp_access_groups?.length ||
+                agent.object_permission.mcp_can_delegate ||
                 (agent.object_permission.mcp_tool_permissions &&
                   Object.keys(agent.object_permission.mcp_tool_permissions).length > 0)) && (
                 <div style={{ marginTop: 24 }}>
                   <Title>MCP Tool Permissions</Title>
                   <Descriptions bordered column={1} style={{ marginTop: 16 }}>
+                    {agent.object_permission.mcp_can_delegate && (
+                      <Descriptions.Item label="Can act on behalf of users (delegation)">Yes</Descriptions.Item>
+                    )}
                     {agent.object_permission.mcp_servers && agent.object_permission.mcp_servers.length > 0 && (
                       <Descriptions.Item label="MCP Servers">
                         {agent.object_permission.mcp_servers.join(", ")}

ui/litellm-dashboard/src/components/agents/types.ts

@@ -8,6 +8,7 @@ export interface AgentObjectPermission {
   mcp_servers?: string[];
   mcp_access_groups?: string[];
   mcp_tool_permissions?: Record<string, string[]>;
+  mcp_can_delegate?: boolean;
 }
 
 export interface Agent {