Workspace isolation
The workspace is derived from the authenticated API key. Requests cannot select another workspace, and resources are returned only when they belong to the key’s workspace.Display-safe resources
Public run resources include status, timestamps, safe outputs, summaries, and bounded error fields. They intentionally exclude:- draft Blueprint graphs and authoring state
- raw browser observations or screenshots
- internal node events and tool arguments
- cookies, website credentials, and secret values
- provider object identifiers and control-plane details
run.snapshot representation.
Credential handling
- Create keys in authenticated Developer settings.
- Grant least-privilege scopes.
- Store secrets in a server-side secret manager.
- Rotate with a bounded overlap window.
- Revoke immediately when a consumer is retired or compromised.
- Never send a key through task text, workflow variables, metadata, URLs, or logs.