Security & permissions
An agent receives user authority, never a back door.
Preview resource server
The API is off by default. A reviewed host configuration pins an RS256 verification public key, exact issuer/audience and subject→existing user/workspace mapping. Token lifetime is bounded. It grants no new FORGE rights and rejects administrator identities.
Current authorization
Every request checks current account activity, lockout, workspace status and Studio grant in FORGE. Draft reads and edits use the same owner scope as the portal. Token scopes only restrict authority; they never create it.
Mutation controls
Revision preconditions, existing revision/audit records, stable processId creation key, per-principal quotas and bounded request size protect the preview. Concurrent retry can return 409; reconcile by reading the owned draft.
Public release gates
Managed OAuth discovery/PKCE, issuer key rotation, revocation policy, distributed quotas, security review, exact-artifact staging and approved public ingress remain required. The stdio preview is not a publicly deployed MCP service. Source documents are untrusted data, never policy instructions.