Security & Guardrails

This page lists what each runtime control covers and where it stops. Configuration lives on the linked pages.

Authentication and scope

Hosted chat, session, and store requests require runtime authentication. Public app access does not grant chat access. See Authentication.

Authorize on verified identity. A verified JWT scope_id takes precedence over a client-supplied scope. Request context can carry untrusted values even when a JWT supplies other context keys.

Session history and resume enforce the scope a verified token is pinned to. A token without a pinned scope, such as an API key or operator token, is not limited to one scope. For a multi-tenant application, keep runtime credentials on your backend and authorize every scope, session, and operation before proxying it. A browser-held token without a pinned scope bypasses those checks. See Embedding.

Coverage

Control	Applies to	Does not apply to
Hooks	Input, model tool calls, string tool results, and assistant text in the root chat loop	Subagent loops, composite child calls, direct tool evals, structured tool results, and reasoning
Endpoint policy and confirmation	Model calls to `request` and native OpenAPI tools	`ctx.request()` in custom tools, MCP tools, and connection-driver tools
Field restrictions	Results of `request` and native OpenAPI tools	`ctx.request()` results, MCP tools, connection-driver tools, and the model's reply

Enforce permissions for uncovered paths in the tool handler or the downstream API. Use a preOutput hook for redaction of the model's reply.

Field restrictions apply only when the response shape matches the policy. Verify removal and redaction with an eval that contains the values to withhold.

Resource access

An agent's declared tools, skills, connections, stores, mcp, and subagents determine its session's resources. Each entry names one resource exactly, with no wildcard. A name that matches no loaded resource grants nothing. Conditional entries in agent.ts can check verified claims through ctx.claims. See Agents.

Runtime HTTP roles (user, admin, ops) are separate from these declarations.

Execution limits

Limit	Default	Effect
Model turns	50	Stops a chat run at the turn limit.
Turn deadline	10 minutes when the caller passes no signal	Aborts the turn through its cancellation signal.
Hook call	1500 ms	A timed-out hook follows its `failPolicy`.