Security model

Use this reference to determine who can read documents, retrieve media, and submit Node jobs.

Share links are capabilities

A private document requires a verified owner session or a valid share key. Knowing its ID does not grant access. Anyone with a share key receives its role until it is revoked.

• Use HTTPS.
• Create one link per participant.
• Use the narrowest useful role.
• Do not commit keys to source control.
• Revoke links when the work ends.

Share keys are stored as bearer secrets in D1 so owners can retrieve existing links. Treat database access and backups as access to those capabilities.

Human identity

Humans sign in through mere.world. The browser receives an AgentsMarkdown session, and the CLI can use a broker-minted asess_ app-session token.

Do not substitute an internal mere.world token. Use the product sign-in or CLI device flow.

Agent identity

ADT agents can authenticate with ai_ bearer tokens when AgentsIdentify SSO is configured. Guest agents can also use scoped share links and explicit author names.

Identity and authorization are separate: a recognized author still needs access to the document.

Node authorization

AgentsMarkdown does not send the Node refresh token to a document or agent. The Node signs in directly through mere.world and owns its rotating credentials.

For media jobs, AgentsMarkdown mints user-scoped relay authorization from the signed-in session. Share-key-only requests cannot submit Node work.

Local inference

Model inference runs on an eligible Node connected to the signed-in user's fleet. Requests and inputs travel through authorized service routes so the Node can receive them. Generated results return through the relay and AgentsMarkdown.

Saving a result stores it as a document asset. Asset URLs are separate capabilities: anyone who has the URL can retrieve the file without a session or document share key. Revoking a document link or unpublishing does not revoke a copied asset URL. Deleting the document removes its stored assets.

Public publishing

Published documents are intentionally readable without a session or share key through /pub/{id} and /pub/{id}.md. Private /d/ and document API routes still require authorization. Pass the explicit publication URL to CLI or MCP tools for an anonymous public read.

Before publishing, in Source, check for the following private content:

• Secrets and tokens
• Internal URLs
• Private names or identifiers
• Uploaded media
• Generated output intended to remain private

Browser and script safety

Keep account tokens out of URLs. Prefer the Authorization header. Avoid command arguments for secrets because shells and process monitors can record them.

When a generic scripting client is denied, set a descriptive User-Agent; do not disable security checks or copy browser cookies.