Reference

Default deny, user credentials, approvals, pinned host, limits, origins and redaction.

• Default deny. Only allowlisted operations are exposed to the model.
• User credentials. Your API sees the signed-in user's own credentials, never a service account.
• Approvals. Non-GET calls need server-verified approval, bound to the exact arguments.
• Pinned host. API calls go to baseUrl only. SSRF guards block private and metadata addresses, and redirects are not followed.
• Limits. Size, step and time limits apply to every turn.
• Origins. Browser calls from origins you did not list are refused.
• Threads. Chat history is bound to the user and only shown to them.
• Redaction. Audit events are redacted. LLM keys, approval secrets and user tokens do not appear in logs or errors.
• Untrusted text. Knowledge passages and API results are passed to the model as data, and rendered as plain text, never HTML.