Security and Governance

Engine 64 enforces workspace and agent scope in the application, but secure operation also depends on the choices your team makes.

Workspace access

• Give each person their own account; do not share sign-in credentials.
• Reserve owner and admin roles for people who manage members, publishing, or deletion.
• Remove access promptly when somebody leaves the team.
• Use separate workspaces where two businesses should not share contacts, conversations, sources, or administrators.

Widget publishing

Widget publishable keys are expected to appear in browser source and are stored as SHA-256 hashes by Engine 64. They identify one workspace and agent; they are not a substitute for the domain allowlist.

• Allow only current production and staging hostnames.
• Revoke unused keys and rotate before revoking when a live site still depends on one.
• Do not put server API tokens in the embed or any browser request.

Content and prompts

Visitor messages, crawled pages, uploaded files, and tool responses are untrusted input. Do not place secrets, private keys, customer records, or internal access instructions in the system prompt or knowledge base. Review crawled pages before enabling them, especially when other people can publish to the site.

Review cadence

At least quarterly, review workspace members, admins, allowed domains, publishable keys, and stored source material. Review them immediately after a team, vendor, domain, or privacy-policy change.