Trust and Security
Cakewalk Agent Access is built on Credential Mediation and a clear layer boundary. This page covers what Cakewalk protects, how and what stays with the downstream apps.
Cakewalk Agent Access enforces trust through structural choices: Agents never see real credentials, the MCP Gateway is the choke point and the audit trail is immutable. This page explains the parts and the boundaries.
📖 Key Concepts
Credential Mediation: Agents never receive real tokens. The gateway holds credentials in a vault and injects them into outbound requests at proxy time.
Reference ID: The opaque, session-scoped identifier the Agent holds in place of the real credential. Useless outside the gateway.
Vault: The encrypted store where Cakewalk holds OAuth tokens. The vault is stateful; the gateway is stateless.
Layer boundary: Cakewalk governs access. Downstream apps enforce what happens once access is granted.
💡 Why this matters: Prompt injection is the primary risk for Agents. With real tokens in an Agent's context, a poisoned document can exfiltrate credentials. With reference IDs, the same attack returns a useless string.
🗝️ Credential Mediation
Credentials live in the Cakewalk vault. Agents receive a reference ID: a session-scoped, principal-bound identifier that means nothing to anyone outside the gateway.
On every tool call:
The Agent presents its reference ID.
The gateway looks up the real credential.
The gateway injects the credential into the outbound HTTP request.
The downstream Connection sees a request that looks like the User made it directly.
The Agent sees the response. The credential never reaches the Agent.
This is the structural mitigation for prompt injection. If the Agent's context is compromised, no real credential can be stolen. The reference ID expires when the session ends.
🛡️ The Vault
The vault is where credentials are stored at rest:
Envelope encryption: Each credential is encrypted with a fresh AES-256-GCM data key. The data key is wrapped with an RSA public key from Cakewalk's key service.
Per-tenant isolation: Each customer's credentials are scoped to their tenant.
OAuth only: Cakewalk ships OAuth Connections.
Rotation: OAuth refresh is handled transparently. The Agent is unaffected when a token rotates.
Credentials belong to the User. When an Agent's reference ID is revoked, the credential stays in the vault. The User can use it on the next session.
🧱 The Layer Boundary
Cakewalk operates at one layer. Other systems operate at adjacent layers. The boundary is intentional.
Access governance
Cakewalk
Should this Agent be allowed to call this tool?
Action enforcement
Downstream app or runtime partner
Within the granted scope, is this specific operation acceptable?
Resource permissions
Downstream app
Can the User access this specific record?
Cakewalk decides whether a tool call passes the gateway and under what action-type constraints. What the Agent does within those constraints at the resource level (this Salesforce record, this GitHub repo, this Notion page) is the downstream app's responsibility.
📜 Audit Immutability
Every tool call produces an audit event. Audit events are immutable:
Cannot be edited after they are written
Survive Policy changes, User offboarding and Agent restriction
Retain the Policy that fired at the time of the call, not the current Policy
Audit is the output of enforcement. Every tool call that passes the gateway leaves a complete record. Tool calls that bypass the gateway, such as direct API access with a leaked credential, are not captured.
🚧 Scope Boundaries
Cakewalk governs access at the Connection and tool-call level. Three things sit outside this scope:
Resource-level access. Per-record permissions (this Salesforce record, this GitHub repo, this Notion page) stay with the downstream app.
Compositional risk. Each tool call is evaluated independently. Decisions based on an Agent's accumulated access path across a session are not part of the current evaluation model.
Agent-to-agent delegation. Sessions are single-Agent. Recursive delegation chains are out of scope.
Related Concepts
The MCP Gateway: the choke point credential mediation runs through
The Tool Call Lifecycle: where credential injection happens (Step 5)
Audit Log: the immutable record of every tool call
Policies: what gets enforced at the gateway
Last updated
Was this helpful?