Security model

Tools Anatomy exists because giving a language model real capabilities is dangerous without hard boundaries. These are the boundaries, as implemented — not as aspiration.

Secrets

• Provider keys and tool secrets are AES-256-GCM encrypted at rest, with authenticated data binding each ciphertext to its tenant and purpose — a ciphertext cannot be re-homed to another workspace.
• Keys are write-only through every surface: after creation, no API response, console screen, or log line contains them.
• Secrets are injected server-side at the moment of execution. The model receives tool results, never credentials.

Governance

• The model can only call tools explicitly bound to its flow, and only fill fields classified as AI-fillable in the published version.
• Execution is fail-closed: unresolvable secrets, missing context, unbound tools, or contract violations refuse the call.
• Disabling a flow takes effect immediately across the API, playground, and widget.

Isolation

• Workspaces are isolated per request and key-scoped end to end.
• Cross-tenant and malformed IDs collapse to not-found — existence is never revealed.
• Each workspace's console access uses its own encrypted platform key.

Audit & telemetry

• Imports, publishes, bindings, executions, secret accesses, and admin actions are audit-logged.
• Telemetry events carry content-free metadata (IDs, durations, outcomes) — never message content, URLs, or key material.