Security and tenancy - Praxa

Keep credentials inside their owning surface. Execution Fabric uses a personal workspace API key. Integration Gateway calls use a short-lived delegated OAuth token. Memory federation receives provider clients that your backend already owns. None of these credentials are interchangeable.

Boundary checklist

Boundary	Required behavior
Browser versus backend	Keep API keys, OAuth tokens, and provider credentials out of browser bundles and browser-visible JSON.
Personal versus organization	Use the workspace authority returned by the server. Do not silently fall back from an unavailable organization to personal mutations.
Subject	Derive or validate the subject according to the selected contract; do not broaden a query because a caller supplied another identifier.
Scope	Request only the named operation scopes. A scope authorizes Praxa policy evaluation, not every provider-side effect.
Provider	A connected provider client keeps its own permissions and data ownership.
Approval	Bind approval to the exact action, target, run, and current authority state.

Negative tests

Run at least these tests before release:

No credential
Malformed credential
Expired or revoked credential
Correct credential with the wrong scope
Valid identifier from another tenant
Valid tenant with another subject
Organization request carrying a personal-only memory scope
Caller-supplied owner or tenant field
Redirect or proxy attempt outside the allowed upstream origin

Last modified on August 14, 2026