Security
Two kinds of control keep the agent secure: verify who the user is so their identity can’t be spoofed, and restrict where the agent runs so your Agent Key can’t be used on other sites.
Verify identity
Section titled “Verify identity”Sign the user context you pass to identify() so the agent trusts it. Pick one:
JWT Verify user identity with a signed JSON Web Token.
HMAC Verify user identity with an HMAC signature.
Restrict where it runs
Section titled “Restrict where it runs” Domain allow list Limit the domains your agent is allowed to load on.
Where to start
Section titled “Where to start”If you pass user context, add JWT or HMAC signing so it can’t be forged. Then lock down the Domain allow list.
Compliance
Section titled “Compliance”Foldspace meets enterprise-grade compliance standards — ISO 27001, SOC 2, and GDPR.