Developer documentation API v1

Identity, inference privacy and authority

Enforce tenant boundaries and purpose-limited processing outside model instructions.

Principal and resource authorization

Authentication identifies a principal; authorization evaluates its operation on a resource in the current workspace and policy context. Object references, including artifact downloads and background jobs, undergo ownership checks. Opaque identifiers do not substitute for access control.

Credentials are validated for their intended audience. Provider credentials belong to the integration boundary and cannot authenticate a Seer principal. The authorization record preserves the chain from human principal through client and agent revision to the executing service.

Effective authority

The intersection expresses that no layer can expand another’s grants. Data entitlement, service budget and account-level financial authority remain distinct predicates. An unavailable policy dependency is not a positive authorization result.

\begin{aligned}G_{\mathrm{effective}}&=G_{\mathrm{principal}}\cap G_{\mathrm{client}}\cap G_{\mathrm{agent}}\cap G_{\mathrm{workspace}}\\ \operatorname{allow}&=\operatorname{scopes}\land\operatorname{entitled}\land\operatorname{owned}\land\operatorname{policy}\land\operatorname{supported}\end{aligned}

Admission algorithm

text

principal = authenticate(credential)
workspace = resolve_current_membership(principal)
revision = load_owned_agent_revision(workspace, request.agent_revision_id)
manifest = resolve_curated_manifest(request.tool)
validate_runtime_schema(request.input, manifest.input_schema)
require effective_grants_cover(manifest.required_scopes)
require data_rights_cover(request.purpose, recipient)
require privacy_policy_allows(outbound_fields, model_route)
reserve_service_budget_atomically()
dispatch_to_domain_owner()
# Financial dispatch additionally requires a current, action-bound authorization.

Inference privacy properties

An inference route binds a model revision to a processing boundary, allowed recipients, retention policy and training-use policy. Dispatch validates these requirements before sending context. A route that cannot satisfy the requested privacy policy rejects the request rather than silently substituting a different processing path.

Tool credentials remain in the credential boundary. Inference receives only the task context and authorized tool results it needs. Workspace persistence, diagnostic telemetry and financial records have separate retention controls; zero-retention inference does not delete those records.

Secrets and prompt injection

Tool invocations carry opaque connection references. Raw secrets are resolved inside the authorized integration boundary and excluded from prompts, model responses, error bodies and ordinary workflow artifacts. Data, inference and execution connections have independent scope and revocation.

Posts, documents and model-generated arguments are untrusted data. They cannot expand grants, request secret disclosure or manufacture approval records. Argument validation and policy evaluation occur after model selection and before effects are admitted.

Audit and retention

The audit chain links resource revisions, timestamps, principals and attributable corrections. Evidence, derived research, execution records and telemetry have separate retention purposes. Hashes detect changes within their defined scope; access control and journal integrity establish additional protections.

Deletion and expiry preserve the consistency of dependent financial records and identify unavailable evidence. Training reuse and cross-workspace analysis require their own permitted purpose. Private workspace records remain separate from transactions observable on a public network.

Capability attenuation and context minimization

Effective capability is the intersection of principal, client, agent and workspace grants. Delegation can narrow that intersection but cannot enlarge a parent grant. Resource ownership, source entitlement, service budget and financial mandate remain additional predicates evaluated for the requested operation.

Context minimization follows the same boundary. A model receives the evidence and tool results required for its task, while connection secrets and signing authority remain behind opaque references. This reduces the information exposed to untrusted instructions without relying on the model to enforce access control.

Policy-bound inference admission

p is the set of required processing properties for a request and guarantees(m) is the verified policy set of a candidate model route. Set inclusion here concerns declared properties such as allowed recipients, retention and training use. Model support, entitlement and availability are additional admission conditions. If no eligible route satisfies the request, admission fails rather than weakening p.

\operatorname{privacy\_eligible}(m,p)\iff\ p\subseteq\operatorname{guarantees}(m)

Read the overview