Skip to main content
Risos resolves every API key to one workspace and enforces that organization boundary inside shared capability calls. Object-not-found responses do not reveal whether an ID exists in another tenant. Use least-privilege scopes, separate keys by environment and integration, rotate regularly, and revoke immediately after suspected exposure. Keep secrets server-side. Source delivery rules may allow derived intelligence while restricting bulk raw-source payloads. Do not attempt to reconstruct or redistribute provider data beyond the returned contract. MCP tools and resources apply the same tenant, scope, and source-delivery controls as REST.