Secure your use of the platform

Duale AI runs your agents. You decide what they can read, which tools they can call, and what happens to the result. This section states where that line falls, what protects your data on each side of it, and which controls you have to build yourself.

Use the six moments below to assign each control before an agent touches production data.

How one task moves through the platform

Every security decision attaches to one of six moments in a task. Meet them in order, then read the page that owns each.

The six moments where a security decision attaches to a taskYour process presents a token, and the platform derives the tenant and agent from it. Your process submits a task, which travels to the platform protected in transit. The platform runs the agent loop, and the agent reads whatever its identity can reach: your Libraries, the web, and documents. The agent asks your process to run your tools, which is where your own code executes. The platform returns a typed result and your application decides whether to accept it. Records are written along the way.

1. Identity. Your process presents an API token. The platform derives the tenant and the agent from it, and never from anything your code puts in a payload. Agents and access owns that boundary.
2. Transit and storage. The task, its documents, and its result each cross boundaries with a different protection. Data protection follows them.
3. Reach. The agent reads every Library its identity was granted, and can browse the web and read documents. That is where text you did not write enters. Threat model states what follows.
4. Your tools. The agent asks your process to run functions you wrote. This is where your code can authorize an external tool action before it happens. Secure integration shows how to write that control.
5. Acceptance. Your application validates the typed result and decides whether the business process can use it. Nothing on the platform makes that decision for you.
6. Records. Some of the above is recorded and some is not. Evidence and audit states which.

Shared responsibility sets out the same split as a table you can take into a review.

Three limits to know before production

Carry these three limits into the production review:

Prompt injection remains possible

Your agent reads documents and web pages that other people wrote. Text in them can carry instructions. The platform gives the model that text unchanged. Threat model states what follows from that.

Approval stays in your code

The platform builds no human review step and no per-action approval gate. Your integration owns that gate, and your tool code must enforce the accepted decision before it causes a side effect. Secure integration shows where to put it.

A tenant is a logical boundary

It separates authorization, configuration, records and cost. It does not give you a separate model-provider account or credential, storage, compute or region. Plan the deployment states what needs a separate deployment instead.

Choose your next page

• Start with the threat model when the agent reads content you do not control.
• Use secure integration while you build tool checks, approval, recovery, and result validation.
• Use data protection to map every place task data crosses or persists.
• Use evidence and audit to separate platform records from the records you must create.
• Use shared responsibility to take that split into a review.

For permitted use, read scope and limits. For binding commitments, read the legal documents.