# Security and access boundaries

Understand how workspace authentication, tool permissions, key handling and source boundaries fit into an Aroai evaluation.

Canonical: https://aroai.com/security/

## Workspace-scoped access

Aroai tools are available through an authenticated workspace. Authorization is checked by the server when a client discovers and calls a tool; display annotations are not access controls.

## Credentials

OAuth sign-in binds a client to a selected workspace. API keys are workspace credentials with configured scopes. Store keys in protected client credentials, rotate exposed secrets and revoke keys that are no longer needed.

## External source boundaries

A tool may call an external data provider or calendar utility. Check each tool's source, access requirements, cost and returned fields. A country or industry pack does not itself grant third-party access.

## Evaluate for your environment

Review your client policy, data classification, permitted source use, vendor requirements and workspace operating process before using Aroai with sensitive information.

- [Enterprise evaluation](https://aroai.com/enterprise): Discuss the controls your team needs to assess.
- [Authentication guide](https://aroai.com/docs/authentication): Review OAuth and API-key setup.

## Security contact

Report a suspected security issue to contact@aroai.com with a concise description. Do not include credentials or unrelated personal data.