1. Threat model
2. Authentication
App passwords
Per-user, revocable.
JWT
Short-lived, scoped.
OAuth
Best for multi-tenant.
API keys
Server-to-server only.
3. Permissions
A service user with role = Editor + capability filters. Never use admin. Never reuse a real user's password.
4. Sandboxing
Tools that touch the filesystem run in containers. Tools that touch credentials run in a separate process with restricted env.
5. Prompt injection
6. Audit logging
Log every tool call with args, response, latency, and user. Stream to your usual sink. Hold for at least 90 days.