> ## Documentation Index
> Fetch the complete documentation index at: https://docs.risos.co/llms.txt
> Use this file to discover all available pages before exploring further.

# Security

> Tenant isolation, least privilege, delivery restrictions, and secret handling.

Risos resolves every API key to one workspace and enforces that organization boundary inside shared capability calls. Object-not-found responses do not reveal whether an ID exists in another tenant.

Use least-privilege scopes, separate keys by environment and integration, rotate regularly, and revoke immediately after suspected exposure. Keep secrets server-side.

Source delivery rules may allow derived intelligence while restricting bulk raw-source payloads. Do not attempt to reconstruct or redistribute provider data beyond the returned contract. MCP tools and resources apply the same tenant, scope, and source-delivery controls as REST.