AgentVisor AI treats request bodies, JWTs, MCP arguments, upstream responses, manifests, and persisted event files as untrusted.

• NHI JWT verification binds algorithms to key types and rejects alg=none, confusion attacks, future timestamps, expired tokens, TTLs above 15 minutes, unknown keys, scope escalation, and delegation depth above four.
• Corporate Ed25519 JWKS keys load at boot and refresh periodically. The last valid set remains available during endpoint failures; a successful refresh retires keys no longer advertised by the IdP.
• MCP calls pass parse, JSON Schema, WASM/native policy, and atomic budget gates. Any failure blocks the call.
• Multi-dimensional action budgets commit through one in-memory transaction or one Redis Lua script.
• WASM policies have fuel and memory limits and fail closed on traps or ABI errors.
• Receipt signatures cover RFC 8785 canonical JSON. avctl receipt-verify requires an independently trusted public key; embedded receipt keys are not trust anchors.
• Active journals use signer-derived HMAC envelopes with contiguous indexes and matched request/terminal response attempts. Recovery quarantines incomplete sessions without stopping unrelated recovery.
• Receipt and close events persist actual broker acknowledgments. Tool executions use exact-request/principal-bound HMAC claims, disable redirects, and cache outcomes to prevent automatic duplicate effects.
• Cold intents are HMAC-authenticated and fsynced before managed broker publication; object writes use create-or-compare semantics.
• Bridge topics reject events that fail their declared JSON Schema.
• Signing seeds use mode-0600 temporary files, exclusive atomic installation, file and parent fsync, and race-loser reload. The image build context and runtime copy exclude seed/key files.
• Session ids are hashed before becoming spool filenames.

• Set require_identity = true and configure identity_jwks_url plus identity_allowed_issuers.
• Mount signing seeds from a secret manager. Do not bake them into images.
• Use TLS/SASL or authenticated private networks for provider, Redis, Redpanda, NATS, Qdrant, and IdP endpoints.
• Restrict /metrics, close, promotion, and the dashboard routes (/dashboard, /api/v1/dashboard/* — enabled by default and unauthenticated, exposing per-session receipts and costs; or set dashboard_enabled = false) at the ingress layer.
• Browser CSRF is blocked by the JSON content-type preflight and denied CORS, but DNS rebinding bypasses both. Set allowed_hosts to pin the expected Host headers (requests outside the list are refused 403 before any handler), keep the listener on loopback or a private network, or enforce Host allow-listing at the ingress.
• Configure customer-owned cold storage and SIEM sinks in Vector.
• Keep old public verification keys available for receipt validation. avctl receipt-verify takes multiple --public-key-hex values (each accepts hex or, as a fallback, standard base64) so an auditor can pin every historical key at once; see docs/reference/OPERATIONS.md for the seed-rollover runbook and docs/reference/VERIFYING-A-RECEIPT.md for the offline verification protocol.
• Keep the configured signing key stable until active journals have drained; rotate only after preserving historical receipt verification keys.

Report vulnerabilities privately to the repository maintainers. Include a minimal reproduction, affected version, impact, and suggested mitigation. Do not include production credentials or customer data.