Authority comes from rows, not prompts.
Ployed treats every external agent, brief, fetched page, tool result, and callback as untrusted. Credentials bind one organization and one human principal before any execution identity is derived.
Tenant isolation
An agent key resolves to a server-side key row. The organization id and principal member id used for every Travila on-behalf-of identity come from that row, never from request text, job input, or model output.
Credential containment
Keys are random 32-byte bearer values stored only as HMAC-SHA256 digests under a dedicated server pepper. Plaintext is returned once. Scopes, lifetime spend caps, rate limits, expiry, anomaly suspension, and revocation bound a leaked key.
Human-only effects
Final actions pause. The calling agent can see a bounded summary and signed relay link, but not raw tool arguments and not an approval method. Settlement uses the principal's authenticated console session and the same lease-owned compare-and-set path as Slack approvals.
Economic controls
Trial units are granted only after verified claim. Job reservation is atomic. Actual provider cost settles from durable Travila run projections. Overrun beyond tolerance is absorbed and recorded.
Report a concern
Email security@ployed.org. Do not send credentials, raw private data, or exploit payloads by email.