Edge, model and tool security
View as Markdown
Open in
Security past the Keys covers three places: the edge every call crosses, the model path an agent reads, and the tools a buyer's agent trusts.
Text an agent reads never decides a move; the gate does. Filled: what a caller sees.
Three places, one gate
Every family below feeds the one decision or runs before it; none of them is a second place a rule can live.
| Family | What it does |
|---|---|
| The edge | Rules against known attacks, floods absorbed before they reach a region, and limits on bursts per address and per Key |
| Bots | operate.edge.bots: allow, challenge or refuse unsigned automated traffic; a signed agent passes on its rung |
| Customer network policy | An IP list and mutual TLS each Customer's admin sets as Verbs, when operate.edge lets it; a call from outside answers 403 |
| Schema at the gate | Every body checked against its Verb's schema and size before anything runs; unknown fields are refused, never ignored |
| Security Events | A burst refused, a failed sign-in streak, a Key used from a new country, a list changed: each an Event a Watch or a sink receives |
| Untrusted text | Text from a Source, an inbound message or a member reaches an agent marked as data; it can ask, never decide, since every tool call still passes the gate |
| Redaction | Fields by data class, redacted or refused before a model sees them, as data governance sets |
| Provider terms | The model router uses only providers that keep nothing and process in the Namespace's region, and a call no such provider serves is refused |
| Output checks | Each generative and agentic Verb's output checked against its returns and its check before it is kept or sent |
| Act classes | Each Verb is read, write, money, sends or irreversible, from its moves or from acts, and a mandate can name the classes it covers |
| Signed tool lists | The tools a product serves, with their act classes, signed and pinned to the Definition's Digest; a buyer's agent re-approves when the list changes |
| Reports | /security on your Domain, rendered from the file, with a Verb that takes a vulnerability report and answers it |
| Act class | MCP annotations | What the decision adds |
|---|---|---|
read | readOnlyHint | Nothing past the Role and the plan |
write | idempotentHint where a retry is safe | The record's state and rules |
money | openWorldHint | A mandate that covers the price and currency |
sends | openWorldHint | Consent on the channel, and the sending identity |
irreversible | destructiveHint | A present person or an approval, never an agent alone |
Example
Filing with the state is irreversible, bots are challenged, and each Customer may set its own IP list and mutual TLS.
import { define, agentic } from 'apis.dev'
/** Annual reports for each client,A buyer's agent reads the signed tool list before it calls, and pins the digest.
{
"tools": {
"definition": "sha256:Rules, lists and keys, state by state
Every move is a Verb on the product's Interfaces or the Operator plane, and each writes its Event.
| Thing | States | What moves it |
|---|---|---|
| A client at the edge | allowed, challenged, blocked, then released | Its traffic against the rules and the bot setting; a block lapses or your operator releases it |
| A Customer's IP list | draft, enforced, removed | The Customer's admin; enforcing it never locks out the admin who set it |
| A mutual TLS certificate | active, expiring, rotated, revoked | The Customer's admin; the product warns 30 days before it expires |
| A security Event | raised, acknowledged, resolved | The edge or the gate raises it; the Customer's admin or your operator answers it |
| A signed tool list | published, then changed and published again | Each deploy that adds, removes or reclasses a tool; each buyer's pin holds until its agent re-approves |
| A vulnerability report | received, triaged, fixed, disclosed | The reporter, your team, and the deploy that fixes it |
What Customers, reviewers and agents meet
- A Customer's admin. Its own IP list and mutual TLS, security Events in its audit log, and a 403 that says which rule refused.
- A security reviewer. The edge rules, how text reaches an agent, which models see which classes, and every tool's act class.
- A buyer's agent. A signed tool list it pins, act classes its mandate can name, and a re-approval when the list changes.
- An agent inside the product. Text it reads cannot widen what it may do, because each tool call meets the gate.
Every call crosses the edge, every text an agent reads is data, and every tool carries its act class, so the gate decides alone.