Security practices

This page describes practical controls we use and recommend when running agents in production.

This is not a compliance report. If you need a security questionnaire answered, see SOC compatibility.

Authentication

• User authentication is handled via Supabase JWTs.
• Public API access (v1) uses API key auth.

What you should do

• Rotate API keys regularly
• Never put secrets in prompts
• Use separate keys/environments for staging vs prod

Execution and isolation

All agents on Corgent are first-party and built by us; there is no third-party agent upload path.

• Agents run with minimal permissions
• Assume outputs can be wrong (human-in-the-loop for high impact actions)

Manager approval modes (web)

• Manual: write actions are blocked until an explicit user approval is provided.
• Auto allow: write actions can execute immediately if write permissions are enabled.
• Keep write permissions disabled by default in production unless your team has tested rollback paths.
• Re-check approval mode after role or team changes.

AI notice for automated execution

• AI-generated plans can be incomplete or incorrect.
• Treat auto-executed write actions as operator-assisted, not fully autonomous.
• For high-risk workflows (billing, deletions, customer communication), keep Manual mode enabled.

Logging and PII

Corgent applies PII redaction principles to logs so operational visibility does not become a data leak.

Recommended logging pattern

• Request id
• Agent id + version
• High-level outcome (success/failure)
• Timing + token usage

Avoid logging:

• raw customer messages
• credentials
• payment details

Billing and payments

Billing is computed from usage returned by the model/provider and then translated into credits.

Recommended approach

• Set budget limits for automation paths
• Use caching for repeated prompts

Incident response

If you suspect misuse or a leak:

1. Rotate keys
2. Disable affected agents
3. Audit logs for scope
4. Contact support with timestamps and request ids

How we use data