Skip to main content
Firedrill authorizes each operation against the current organization, project, environment, and credential capabilities. Knowing a resource ID or report URL does not grant access.

​
Three credential boundaries

Do not substitute one for another. The agent under simulation should receive its narrow Tool connections, not your Firedrill operator credential.

​
Human authorization

The CLI and coding-agent integration use a browser approval flow. The human selects an authorized organization; first-time registration names its organization. An invited user joins the invitation’s organization. Current membership and authority are checked rather than treating a saved selection as permanent permission. Complete required email verification or invitation acceptance; do not create another organization to bypass it.

​
Automated execution

Store FIREDRILL_TOKEN in a protected secret store. Scope it to the intended project/environment and capabilities, give it an expiry, and revoke it when no longer needed. The service enforces that scope independently of CLI flags or SDK configuration. CI must not expose credentials to untrusted pull-request code.

​
Synthetic state and Tool code

Independent simulation cases receive independent synthetic instances. A Tool’s declared operations and connections do not grant access to another instance. Custom Tool behavior runs under its declared restricted capabilities. Review source, selected data, schemas, and returned build/conformance results. A build result is not a guarantee of complete vendor fidelity. Native callbacks and ordinary commands still execute in your own process or machine. Tool isolation does not isolate arbitrary customer code.

​
Evidence and files

Reports, screenshots, traces, documents, and downloads require scoped authorization. Downloads use the authenticated product API, not public storage links. Capture only what you intend to retain. Redact provider tokens, customer information, and private application data before uploading it. Uploaded observations can be untrusted input to an evaluator; they are not authority to change the rubric or access other projects. Payload expiry, metadata retention, and explicit removal are separate. Inspect the returned retention state instead of assuming every historical file is still available. See team access, authentication, and evidence.