Agent and client identity
Requests bind to trust status, credential envelope, scoped access key, task token, and allowed tool route.
OS Security Hardening
Security boundaries for runtime work.
Wever Labs runtime rails carry intake records, Work Orders, provider confirmations, credits, tool commands, result contracts, receipts, callbacks, ledgers, and attestations. The security boundary defines how those records are authenticated, scoped, validated, written, delivered, retried, and disabled when needed.
Runtime boundary
Every live rail needs a security control point.
The OS security layer keeps public discovery separate from runtime writes, service-role actions, provider secrets, callback delivery, and controlled pilot execution.
Provider and service-role boundary
Provider credentials, webhook secrets, Supabase service-role keys, and signing material stay in environment variables and server-side functions.
Payload and callback controls
Runtime functions validate tool, schema version, callback target, provider event, credit funding event, and result envelope before writes.
Inspectable operating events
Security-relevant actions create audit events for intake, dispatch, execution, provider confirmation, callback delivery, retry, and kill-switch use.
Activation controls
The security boundary prepares controlled pilots.
TokenOps, FinanceOps, and EnergyOps run through the same control model: trusted entry, scoped execution, validated provider events, bounded callbacks, audit events, and operator-visible state.
Authenticate
Bind request identity to agent, client, credential envelope, and allowed tool scope.
Validate
Check payload schema, provider event, callback URL, and Work Order route before runtime writes.
Write
Use server-side service-role actions to create runtime records, credit events, and result objects.
Audit
Create security events for sensitive actions, retries, failed checks, and operator overrides.
Control
Provider routes, callback delivery, and pilot runs can be disabled by kill-switch state.
Continue through the OS
Security binds into the activation path.
Move from the security boundary into runtime deployment, function wiring, callback delivery, or controlled pilot execution.