Editing Synapolis/Agent Substrate API Catalog (section)

== Security notes for agent substrate ==

* Secrets in prompts are exfiltration, not "context". Treat API keys, seed phrases, bearer tokens, SSH keys, cookies, private repo credentials, customer data and unpublished business plans as out-of-scope for third-party API calls unless the contour explicitly allows it.
* BYOK aggregators reduce integration work but increase blast radius: the aggregator can see prompts and may hold provider keys, route metadata, spend history and error traces. Use direct provider APIs or self-hosted gateway for sensitive work.
* Browser/search tools are prompt-injection surfaces. A web page can instruct the model to reveal memory, call tools, change code, or ignore policy. Search/extract output must be treated as untrusted data, not as system instructions.
* RAG vectors are derived sensitive data. Embeddings can leak semantic content and should be partitioned by sensitivity, model, tenant and deletion policy.
* Low-policy/open-weight does not remove law, copyright, privacy, export-control or platform abuse obligations. It only shifts enforcement from provider to Synapolis.
* For high-security agents: prefer local/self-hosted inference, no prompt logging, encrypted volumes, network egress allowlists, per-agent virtual keys, spend limits, and separate browser/search sandbox from credentialed tools.