Security & Permissions

Security and Permissions Overview

User-facing security model for isolation, Chat Access, and secret protection

Security and Permissions Overview

Downcity security has three layers:

  1. Agent isolation: one running agent is bound to one projectRoot.
  2. Chat Access: per-Agent grants decide which external Chat users can send messages into the Agent.
  3. Data protection: model provider apiKey is encrypted in ~/.downcity/downcity.db.

What to watch first

  1. Avoid stale DC_CITY_HOST/DC_CITY_PORT in your shell, or requests may hit the wrong agent.
  2. New users cannot enter an Agent by default, so review pending Access Requests after enabling a channel.
  3. In production, prefer DC_MODEL_DB_KEY from secret management.
  1. API Authentication
  2. Permissions
  3. Data Security and Keys
  4. Invocation Routing and Isolation

Project Logic Overview

One-page overview of Downcity as reusable agent infrastructure for AI builders

API Authentication

Understand the Bearer-token authentication boundary used by Downcity APIs

Table of Contents

Security and Permissions OverviewWhat to watch firstRecommended reading