AI GridDocs
Sign Up

Security

Where enforcement happens, how credentials and provider keys are stored, and what happens to the data you send.

Updated Sep 9, 2026

The boundary is the API, not the interface#

Every permission check runs server-side, on every request. The navigation you see is a usability cue — hiding a control does not protect it, and knowing a URL does not grant access to it. A selector header such as X-AIGrid-Project requests a context; it never carries authority.

That matters practically: you cannot widen someone's access by giving them a link, and you cannot narrow it by hiding a menu. If you want to change what a person can do, change their grants.

API keys#

Keys are random 256-bit credentials (aig_ + token). AI Grid stores only a SHA-256 hash plus a short display prefix — a read of the store yields nothing usable, and raw keys are never logged. The full secret is shown once, at creation; an idempotent replay of the creation request does not reveal it again.

  • Revocation refuses the key's next admission. A call already admitted settles as recorded, so financial and audit records are never stranded.
  • Rotation mints a replacement secret and revokes the old key immediately — there is no overlap window, so deploy the new secret before you rotate.

Provider credentials#

Upstream provider keys are added by platform administrators only — organizations cannot supply their own provider credentials. Stored provider keys are encrypted with AES-GCM, under a domain-separated key derived from the session secret, with the connection ID as authenticated associated data. API responses, idempotency results and audit notes never contain the plaintext or the ciphertext.

On the network side, the provider adapter disables proxies and redirects, resolves DNS per connection, refuses private or reserved destinations, and pins the connection to the checked address while retaining TLS hostname verification.

What happens to the data you send#

  • Prompts are not separately logged. Usage rows, consumption detail and audit events carry metadata — time, project, key prefix, product, tokens, status, latency, amounts — never prompt or response content.
  • Responses are retained in the private Core database solely so that an idempotent replay can return the same answer. They are not exposed on any read surface.

Guardrails fail closed#

Owner-managed invocation policies can compose content guardrail packs (PII, secrets, prompt injection) at one of three actions — observe, mask or block — with the strongest applicable action winning. Screening runs inside the admission transaction, before any money is reserved, and a screening failure aborts the call rather than letting it through unchecked.

Blocked calls are refused with 403 content_policy; the error says the request was blocked, not what matched. Guardrail audit events store rule counts, never the matched text.

Audit#

Consequential actions record an audit event with the actor, the action, the reason and the time. That covers membership and grant changes, product submission and review, publication and suspension, assignments, the full key lifecycle, provider-connection changes, and every reservation, settlement and reconciliation. Organization Owners and Administrators can read their organization's financial audit; platform administrators hold the cross-organization trail.

Platform architecture#

Sign-in runs through Keycloak (OIDC single sign-on). Authorization decisions are evaluated through OpenFGA (relationship grants) and OPA (contextual policy) — both behind adapters, so the business truth stays in AI Grid Core and the engines execute decisions rather than owning them. The admin console carries read-only evidence pages for each service.

Next#