Security

Overview

MC-1 policy is one control layer. Secure deployment also requires application authorization, secret management, network boundaries, provider contracts, logging discipline, and incident response.

• Keep API and provider keys server-side.
• Classify and minimize prompt data.
• Restrict regions and providers contractually and technically.
• Verify and revoke agent identity.
• Redact sensitive headers and content.
• Test denied and approval-required actions.

Production checklist

• Keep credentials in a server-side secret store.
• Set explicit cost, latency, privacy, provider, and regional constraints.
• Capture route and evaluation evidence for incident review.
• Test timeouts, cancellation, fallback, and denied-policy paths before rollout.