Trusted request path
Browser code authenticates with your application. The application server resolves the person, tenant or organization, and allowed model before calling the runner with a server-owned token. Provider credentials remain in Desktop settings or trusted Kestrel One services.
Required controls
- Parse and validate external input before using it.
- Never expose runner or provider credentials in browser-readable variables, responses, or transcripts.
- Bind every request to an authenticated actor and tenant or organization.
- Authorize Project, Thread, file, Knowledge, artifact, and model access before returning data.
- Keep control actions and final run outcomes in history.
- Require a reviewed change plan for schema migrations, irreversible data moves, and policy changes.
Verify the controls
Test both an allowed and denied request with non-administrator test accounts. Confirm that a denied request returns no protected metadata, file content, model endpoint, or credential. Review browser bundles and network responses for secrets before release.