Skip to Content
Agent integrationsSecurity and permissions

Agent integration security

Give an agent only the access needed for its assigned task. Keep user sign-in, application credentials, and independent verification identities separate.

Review access before allowing a change

  • Give MCP clients the same user access the person needs in the portal, no more.
  • Review the application, record, and proposed change in every write confirmation before allowing an agent to continue.
  • Store CLI user credentials in the operating-system credential store.
  • Store application keys in an approved application secret manager.
  • Download entitled SDK and CLI packages through the customer portal. You do not need a GitLab credential.
  • Give the Azure verifier identity access only to the required ledger evidence and verification procedure.
  • Never put tokens, application keys, database connection secrets, or package credentials in an MCP prompt, evidence pack, repository file, or support log.

Keep authorization in VeriProof

VeriProof records MCP write actions with the requesting user and an idempotency key. That key distinguishes a retry from a new request. It does not grant permission.

The application services enforce tenant and application access. An instruction in a prompt cannot expand that access. If an operation is denied, review the user’s assigned scope instead of substituting a broader credential.

Dedicated deploymentsTroubleshooting