> For the complete documentation index, see [llms.txt](https://www.cakewalk.security/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.cakewalk.security/docs/ai-agent-access/concepts/trust-and-security.md). # Trust and Security Cakewalk Agent Access enforces trust through structural choices: Agents never see real credentials, the MCP Gateway is the choke point and the audit trail is immutable. This page explains the parts and the boundaries. *** ### 📖 Key Concepts * **Credential Mediation**: Agents never receive real tokens. The gateway stores each credential encrypted, resolves and decrypts it server-side, and injects it into outbound requests at proxy time. * **Server-side injection**: The Agent holds no credential and no stand-in for one. The gateway resolves the stored credential from the authenticated principal and injects it as a Bearer header; nothing credential-like ever enters the Agent's context. * **Encrypted credential store**: OAuth credentials are persisted encrypted, scoped per tenant. They are never stored in plaintext, and the credential is never returned to the Agent. * **Layer boundary**: Cakewalk governs access. Downstream apps enforce what happens once access is granted. :bulb: *Why this matters:* Prompt injection is the primary risk for Agents. With real tokens in an Agent's context, a poisoned document can exfiltrate credentials. Because the Agent never holds a token or any stand-in for one, the same attack has nothing to exfiltrate. *** ### 🗝️ Credential Mediation Credentials are stored encrypted, scoped to the User and tenant. The Agent never receives the credential or any stand-in for it. On every tool call: 1. The Agent makes the tool call through the gateway, identified by its own session and principal. 2. The gateway resolves the User's stored credential for that Connection and decrypts it server-side. 3. The gateway injects the credential as a Bearer header into the outbound HTTP request. 4. The downstream Connection sees a request that looks like the User made it directly. 5. The Agent sees only the response. The credential never reaches the Agent. This is the structural mitigation for prompt injection. If the Agent's context is compromised, there is no credential in it to steal. Access stops when the Agent's session or the User's Connection is revoked. *** ### 🛡️ The Encrypted Credential Store The encrypted store is where credentials live at rest: * **Envelope encryption**: Each credential is encrypted with a fresh AES-256-GCM data key. The data key is wrapped with an RSA public key from an external key management service (AWS KMS), so the gateway process cannot unwrap it on its own. * **Per-tenant isolation**: Each customer's credentials are scoped to their tenant. * **OAuth only**: Cakewalk ships OAuth Connections. * **Rotation**: OAuth refresh is handled transparently. The Agent is unaffected when a token rotates. Credentials belong to the User. When an Agent's access is revoked, the stored credential is untouched and the User keeps their Connection. *** ### 🧱 The Layer Boundary Cakewalk operates at one layer. Other systems operate at adjacent layers. The boundary is intentional. | Layer | Who owns it | Example | | ------------------------ | --------------------------------- | ---------------------------------------------------------------- | | **Access governance** | Cakewalk | Should this Agent be allowed to call this tool? | | **Action enforcement** | Downstream app or runtime partner | Within the granted scope, is this specific operation acceptable? | | **Resource permissions** | Downstream app | Can the User access this specific record? | Cakewalk decides whether a tool call passes the gateway and under what action-type constraints. What the Agent does within those constraints at the resource level (this Salesforce record, this GitHub repo, this Notion page) is the downstream app's responsibility. *** ### 📜 Audit Immutability Every tool call produces an [audit event](/docs/ai-agent-access/concepts/audit-log.md). Audit events are immutable: * Cannot be edited after they are written * Survive Policy changes, User offboarding and Agent restriction * Retain the Policy that fired at the time of the call, not the current Policy Audit is the output of enforcement. Every tool call that passes the gateway leaves a complete record. Tool calls that bypass the gateway, such as direct API access with a leaked credential, are not captured. *** ### 🚧 Scope Boundaries Cakewalk governs access at the Connection and tool-call level. Three things sit outside this scope: * **Resource-level access.** Per-record permissions (this Salesforce record, this GitHub repo, this Notion page) stay with the downstream app. * **Compositional risk.** Each tool call is evaluated independently. Decisions based on an Agent's accumulated access path across a session are not part of the current evaluation model. * **Agent-to-agent delegation.** Sessions are single-Agent. Recursive delegation chains are out of scope. *** ### Related Concepts * [The MCP Gateway](/docs/ai-agent-access/concepts/the-mcp-gateway.md): the choke point credential mediation runs through * [The Tool Call Lifecycle](/docs/ai-agent-access/concepts/the-tool-call-lifecycle.md): where credential injection happens (Step 5) * [Audit Log](/docs/ai-agent-access/concepts/audit-log.md): the immutable record of every tool call * [Policies](/docs/ai-agent-access/concepts/policies.md): what gets enforced at the gateway --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://www.cakewalk.security/docs/ai-agent-access/concepts/trust-and-security.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.