Security model for AI agents
Last updated
How a coding agent reaches your Unhandled data, what it can do there, and what stops it. Unhandled hosts the MCP server. The agent and its model run on your side.
1. How an agent connects
An interactive agent such as Claude Code, Cursor or Codex connects with OAuth 2.1 and PKCE. A person signs in, picks the organizations and scopes on the consent page, and the agent gets a one-hour access token and a refresh token that stops working after 30 idle days and is revoked if it is ever reused.
When an organization requires single sign-on, the consent page sends its members through the organization's identity provider first.
Headless agents, such as a CI job or a cloud agent, use an agent identity an admin creates. It has its own scopes, an expiry of at most 90 days, an optional IP allowlist and its own rate share. It never approves anything.
2. What an agent can do
Scopes decide which tools an agent sees, and an organization's scope cap limits what any grant can hold. Agent access is never limited by plan.
Calls that grant access, delete data, issue a key or send data somewhere new do not run on the agent's word. The agent gets a link and a person approves the exact arguments in the browser. Organizations can require approval for more.
Reads have an hourly budget per organization, so a runaway agent cannot exhaust the database.
3. Untrusted text
Error messages, logs, user feedback and span attributes come from your applications and their users, so a tool result marks every such field as untrusted data, never instructions. Clients that hide that metadata still see a provenance note at the top of the result.
The organization's AI data policy masks secrets, and optionally personal data, before text reaches an agent or a model.
4. Audit and revocation
Every MCP call is recorded with the person or agent identity, the client, the tool, its outcome and its duration, and kept for a year. Admins can filter and export it and revoke a connection from any row.
Revoking a connected app, an agent identity or a member ends their tokens at once. A SCIM deprovision from the organization's identity provider does the same for the person's connections, grants and agent identities in every organization.
5. Where models run
Unhandled runs no model for agents and holds no AI seats. Your agent's model is chosen and paid for by you. In-product AI summaries use only the organization's own provider key. AI: none of Unhandled's; customer-chosen provider under customer contract.