Security

UAR treats authentication, tenant identity, provider credentials, and tool execution as separate trust boundaries. No one control implies the others.

Start with Authenticate Requests, the current authority for JWT, JWKS, API keys, anonymous mode, and probe exceptions. Then use:

• Manage Provider Credentials for encrypted, user-scoped provider keys;
• Understand Tenant Boundaries for the current A2A-only partition claim;
• Apply Governance Policies for Cedar coverage and its present fallback;
• Resolve Tool Approvals for permitted-but-sensitive tool calls.

Deployments still own TLS termination, edge authentication, secret custody, storage access, and external service policy. Report vulnerabilities through the repository's security policy.