Status: The personal partner-preview gateway, API-key authority, strict
minimal task boundary, tenant-bound run/usage reads, and server-owned billing
admission are live. Unified policy, BYO credentials, organization execution,
and mature receipts are unavailable.
Trust boundaries
Client. Holds a credential and requests an operation. It cannot assign its
own identity, tenant, roles, billing account, tools, model, policy authority, or
approval.
Gateway. Validates protocol/method/path, bearer key admission, endpoint
scope, request/body limits, and CORS, then strips external authorization state
before private service-binding dispatch. Gateway admission is necessary but
not final point-of-effect authority.
Runtime and database authority. Re-resolve the key, tenant, actor, resource
ownership, scopes, funding, current state, and mutation invariants. Privileged
provider, connector, webhook-signing, and database credentials remain inside
this boundary.
Current client constraints
- no request
userId, tenant assignment, or organization execution;
task.agentId, context, tools, policy, and delivery are rejected;- exact four-value key scope enum;
- foreign/unknown resources are not projected;
- cancellation is cooperative and cannot assert rollback;
- usage is customer-safe evidence, not authority to change billing.
API-key handling
Praxa creates 32 random bytes and returns the praxa_sk_ secret once. It stores
a SHA-256 hash plus safe lifecycle metadata, not recoverable plaintext. Create
and rotate responses are no-store; list responses never expose the hash or
tenant id. Rotation and revocation recheck authoritative storage even while an
edge projection propagates.
Existing custom-agent deployment keys remain a separate credential family.
Webhook boundary
Partner-preview webhook management rechecks tenant and actor at the server-owned
point of effect. Endpoint destinations must be public HTTPS and pass
SSRF-resistant validation. Signing secrets are generated once, encrypted with
AES-256-GCM at rest, and returned only by create. Gateway authorization headers
are removed before private dispatch.
Automatic task projection and bearer management are active for admitted
personal tenants. A production canary verified a delivery signature against the
exact raw body. Retry, dead-letter, eligible replay, and redirect-safety
exercises remain separate operational canaries.
Approval boundary
Existing Praxa product gates fail closed. The first source-ready public form is
an exact immutable browser action. Praxa must be able to re-derive the exact
instruction/steps, host, approval reference, and digest; otherwise it emits
nothing and refuses the mutation.
That is not a unified customer-configurable policy engine, and it does not make
generic approvals, peer review, organization approver roles, or mature approval
receipts available.
Credentials not yet supported
BYO provider credentials are planned. Because provider credentials must be
used, a future implementation would require reversible envelope encryption,
not hashing, and strict tenant/runtime confinement. No such public funding mode
is live today.
Deployment and isolation gaps
The live preview is personal-only. Organization delegation, formal fabric
isolation audit, dedicated accounts/regions, evidence export, SSO/SCIM, and
centralized broker revocation are unavailable. Self-hosting is not offered.
See also
Last modified on August 14, 2026
