04. Security Operations

This chapter has moved to pages organised by task.

What you want to do	Page
Where the isolation boundary is, how to handle the remaining risks, reporting a vulnerability	Understand the threat model and residual risks
What AF_MASTER_KEY and AF_COOKIE_SECRET must be, a deployment without a key, values stored before the key, per-purpose cookie keys	Handle the deployment keys
Observe outbound traffic from workspaces and narrow it with an allowlist	Control outbound traffic
OAuth for /mcp, trusted client hosts, members’ OAuth MCP servers, the /mcp log	Operate MCP and external-connection sign-in
AUTH=dev and the development OIDC IdP	Use development sign-in
The preview domain, the sign-in allowlist, the audit log, the host’s cloud identity, handing over the browser	Other operational controls
Remove someone, end everybody’s sessions, hand over super_admin	Revoke access and hand over super_admin