Control Mechanisms / Keys
scopes · rate_limit · ip/referer/origin allowlist · residency Swarm phase Coordination, not flow: a key is a heading with limits — which providers, what rate, from where.
The principle
Every restriction here is defined on the key itself, so it travels with the credential rather than living in a separate policy engine you have to keep in sync. You write the narrow policy once; the controls that enforce today do so immediately, and the ones rolling out record and audit against real traffic first, then switch to blocking without a redefinition.
Narrow a key to the providers and operations it is allowed to reach. Scopes are recorded and shown today; enforcement is switching on key class by key class rather than in one flip, so a scope reads as an audit signal now and a hard block as it rolls out.
Set a per-key request ceiling. It is validated and recorded now — you can define and audit it against real traffic — and becomes a hard throttle as enforcement is switched on, without you re-defining anything.
Restrict where a key may be used from — an IP range, a set of referers, a set of origins. The lists are validated and matched today in audit mode; the block flips on at rollout, so the policy you write now is the policy that enforces later.
A key is pinned within its workspace’s region — it can never reach outside it, the pin is written once, and it can only ever be widened, never silently narrowed or moved. This one is enforced today.
Stated precisely on purpose: the tags are the honest state of each control. Per-key residency enforces today. Scopes, rate limits and allowlists are defined and audited now and move to hard enforcement key class by key class — described as what they do today, not what they will do once every flag is flipped.
More in this area
Connect over MCP or REST. If your agents read more than one source, the context bill is the first thing you will see move.