PERMISSIONS AND ACCESS CONTROL

IDENTITY AND SECRET HANDLING Identity answers the question of who or what is making the request. In agent systems there can be several identities: the human user, the agent itself, and the tools or services it connects to. Authentication is proving identity, and authorization is deciding what that identity may do. Being clear about whose authority an agent acts under matters. An agent acting for a user should typically have no more power than that user, and often less. SECRETS A secret is any value that grants access and must stay private, such as a password, an API key, an access token, or a private cryptographic key. An API key, where API stands for Application Programming Interface, is a long string that identifies a program to a service, much like a password for software. Secret handling means storing and using such values safely.