Security

Transport is HTTPS-only; HSTS and a baseline Content-Security-Policy are enforced, and technology-stack fingerprint headers are suppressed.

Agent tool execution is gated by a four-stage control plane: classification boundary check, policy engine, human-in-the-loop approval tickets, and (for L3+ tools) an isolation layer. Approval tickets are single-use and bound to tool, arguments and tenant.

Authentication supports OIDC (RS256/JWKS) with fail-closed behaviour: an unauthenticated or unverifiable control-plane request is rejected rather than silently downgraded.