Security

Use the narrowest credential

Put an app key only in the service that creates runs.
Put a worker key only in the process that executes private tools.
Never use a console session or platform-admin token in application code.
Use separate credentials for staging and production.
Rotate app and worker keys independently.

Store credentials in a managed secret store. Never commit them, bake them into an image, log them, or pass a worker key through --key in a shared environment.

Authorize inside every tool

Agent-generated arguments are untrusted. Validate every value before using it in a query, URL, or shell command. When a tool receives context, verify that the requested object belongs to the authenticated tenant.

from air import tool


@tool
def get_invoice(invoice_id: str, context: dict) -> dict:
    """Read an invoice owned by the current tenant."""

    tenant_id = context["tenant_id"]
    invoice = load_invoice(invoice_id=invoice_id, tenant_id=tenant_id)
    return invoice.to_safe_dict()

Grant capability in layers

A worker registers a manifest.
A project owner reviews and enables the tool.
An agent version explicitly includes the tool.
The tool enforces tenant and object authorization at execution time.

AIR tool approval dialog with schema and write action control — AIR makes the tool source, schema, timeout, and write capability visible before approval.

Respond to an exposed key

Revoke it immediately, issue a replacement, update the affected deployment, and inspect recent runs, worker registrations, and audit events for unexpected activity.

Start here

Build agents and apps

Connect private tools

Operate safely

SDK reference

Use the narrowest credential

Authorize inside every tool

Grant capability in layers

Respond to an exposed key

​Use the narrowest credential

​Authorize inside every tool

​Grant capability in layers

​Respond to an exposed key

Use the narrowest credential

Authorize inside every tool

Grant capability in layers

Respond to an exposed key