Access control

The security review describes token, tenant and execution trust boundaries, tested defenses and remaining native-isolation qualification.

Applications own their authentication and choose their auth stack. Consuming the SDK requires no AgenticDriver account, extra login service or auth migration. Application identity, authorization to an execution host, and a provider account's native sign-in are separate concerns; provider credentials stay on the execution host.

Connect an existing authorization system#

A programmatic host accepts the HostAuthentication interface exported from @agenticdriver/sdk/server. Its authenticate(token, signal) checks the current credential and returns an AuthenticatedPrincipal, or undefined to deny it. The principal contains an opaque authorization id, a canonical subject, and explicit provider, tool and other resource grants. Map those fields from the application's trusted current policy, never from request metadata. Protect the existing identity service's credentials and honor the supplied cancellation signal.

Supply this adapter as serve(driver, { authentication, ...options }), or through the programmatic configured host. Use either authentication or static tokens, never both. Static tokens have explicit host-owned grants but no built-in expiry or rotation. Detached jobs additionally require resolveJobPrincipal(id, signal) to recheck a durable, revocable grant after restart; never use a bearer as its ID. See the public contract and host configuration.

The host connection flow and desktop companion also support scoped host invitations and connection management without imposing an application identity provider. Choose that flow or an application-owned credential flow according to the integration. Browser cookies alone never authorize SDK requests.