# Security model

> Default deny, user credentials, approvals, pinned host, limits, origins and redaction.

Source: https://sideagent.dev/docs/security

- **Default deny.** Only allowlisted operations are exposed to the model.
- **User credentials.** Your API sees the signed-in user's own credentials, never a service account.
- **Approvals.** Non-`GET` calls need server-verified approval, bound to the exact arguments.
- **Pinned host.** API calls go to `baseUrl` only. SSRF guards block private and metadata addresses, and redirects are not followed.
- **Limits.** Size, step and time limits apply to every turn.
- **Origins.** Browser calls from origins you did not list are refused.
- **Threads.** Chat history is bound to the user and only shown to them.
- **Redaction.** Audit events are redacted. LLM keys, approval secrets and user tokens do not appear in logs or errors.
- **Untrusted text.** Knowledge passages and API results are passed to the model as data, and rendered as plain text, never HTML.