Secure AI agents
Agents can read any file they can open. Keep authsia:// refs in those files, and let Authsia resolve secrets only after you approve a scoped grant.
Non-negotiables
- Do not run
get/readin an agent context if that would print a secret. - Files agents inspect should contain refs, not plaintext.
- Approved
execorworkspace runputs the secret in the child only. - When access is missing, the agent must stop — not fall back to plaintext commands.
Choose a path
| Use this | When | Guide |
|---|---|---|
| Agent JIT | The agent needs scoped list or exec for a folder and TTL you approve each time (or until expiry). |
Agent JIT |
| MCP tools | The client should call Authsia through six fixed tools, with no secret-return tool. | Local MCP server |
| MCP Manager | A workspace-declared local STDIO or localhost HTTP MCP should run only after admission or secret JIT. | MCP Manager |
| Automation credential | A reusable, named credential for scripts — not the JIT grant path. | access create |
Launch from a workspace
Workspace Agent launches, app menu launches, and hand-typed claude, code, codex, cursor, devin-desktop, or devin start the agent child without guard markers. Authsia restores the pre-guard PATH for that child while leaving the parent tab guarded.
Install setting-aware agent rules plus command-attribution and sub-agent-lineage hooks with authsia agent init --agent codex, then open /hooks in Codex to review and trust them.
Workspace Setup offers the same Codex integration, shows both generated paths, and keeps any manual hook-merge steps visible until you dismiss them.
Enable MCP Integrations in Settings > Developer Access before connecting a client. Client configuration cannot turn this on.
Approve and revoke
A grant covers the approved directory and its descendants, never siblings or symlink escapes. A grant at $HOME or / stays at that exact directory. Revoke from Access Center, a paired iPhone, or authsia access revoke.
See Access Center and Agent-safe workflows.