How Duct handles credentials, permissions, consent, cross-shell delegation, and operational data.
Last updated: July 18, 2026
Credential model
Duct issues credentials — Shell IDs, Secret Keys, agent access profiles, shell tokens, and delegation tokens. Customers do not mint platform credentials themselves.
Secret Keys and profile webhook secrets are shown once at creation. Duct stores only hashed or encrypted forms.
Key rotation and profile deactivation are available from the dashboard without downtime.
Never embed Secret Keys in client-side code. Use server-side token exchange for user sessions.
Access control
Every action in a manifest has explicit permission rules — who may call it, whether it is agent-accessible, and whether it has side effects.
The invoke API validates every request against the manifest before your API is contacted.
Side-effect actions require an explicit consent trace — in chat via ConfirmCard, or via the 202 + execution token flow for agents.
Shell-to-shell calls are gated by per-shell settings: intershell_enabled, registry visibility, agentAccessible flags, and optional allowedCallers lists.
Token lifecycle
Shell session tokens, agent tokens, guest tokens, and delegation tokens are short-lived — typically minutes to one hour.
Delegation tokens for cross-shell calls are single-use with a 60-second TTL, scoped to one action.
User consent tokens expire at session end or after 24 hours, whichever is shorter.
There are no long-lived platform credentials in the path between a caller and your API.
Network and proxy safety
Outbound requests to your API pass through SSRF guards — only configured base URLs are reachable.
Cross-shell call chains are depth-limited, HMAC-signed, and checked for circularity.
Rate limits apply per shell pair and per target shell for intershell traffic.
Third-party action results entering the agent loop are tagged as external and treated as untrusted input.
Data handling
Conversation context is retained only for active sessions and expires when the session ends or times out.
Persisted telemetry uses redacted message previews and entity fields — sensitive patterns are stripped before storage.
Partitioned interaction events and operational logs are subject to automated retention. The platform default is 90 days; longer retention may apply for security or legal reasons.
We do not use your company's data or end-user content to train AI models.
Your responsibilities
Keep manifests accurate — only expose actions you intend to be callable.
Protect dashboard access and rotate credentials if a team member leaves.
Configure your API to trust only Duct-originated requests as documented.
Review shell-to-shell settings before enabling public discovery.
Responsible disclosure
Found a security issue? Report it through the contact form on the support page.
We aim to respond within 24 hours and will work with you on coordinated disclosure.
Please do not test against customer shells without authorization.
“Found a security issue? We aim to respond within 24 hours.”