Switchboard
How it worksRequest access

Security

Centralized is high-value. We design for that.

Switchboard is built so provider credentials stay off caller machines, tenants stay namespaced, and operator actions are audited. Production cells enforce these controls; local/dev stand-ins are intentionally looser for smoke tests.

Credentials

Keys stay at the edge of egress

Production cells use a node-local injector that adds credentials to outbound requests over a Unix socket—the gateway process is not meant to retain raw vault secrets. Destination hosts are pinned (including resolved-IP checks); private ranges are rejected; cells egress from fixed NAT IPs you can allowlist.

Operator access is gated

Console sessions are server-side; admin APIs require a dedicated sys key, not a caller key. Humans authenticate via OIDC; secrets stay off the browser.

Secrets at rest

BYO and provider secret maps seal with a cell passphrase (HKDF). Production refuses to start without SB_SECRETS_KEY.

Containment hooks

Per-key deny/revoke, ip_allowlist, and anomaly hooks exist so a single compromised credential can be cut without taking the cell down.

Identity

Four key kinds. One model.

App & agent keys

Your services and MCP tool loops. Customer id must be namespaced; agents get approval gates and tighter limits.

Customer keys

External developers. Identity comes from the credential (or short-lived OAuth JWT), never a free-form header.

Sys / operator keys

Platform operators and machines (console BFF, publish jobs). Admin routes require KindSys—caller keys get 403.

Reliability under failure

Degraded modes are written down

Last-known-good config when the control plane is down. Token leases when Redis blinks. Fail-closed hub dedupe—not silent double sends. Side-effect timeouts record unknown, never guess.

What we prove in drills

  • Game days: kill Redis, Postgres stand-in, injector, a zone
  • Rotation drill under 15 minutes with zero failed calls
  • Webhook provider-retry drills with zero lost events
  • Hub overhead SLO target: p99 under 15 ms including the injector

What we don't claim

  • Policy does not detect prompt injection—it gates tools and side effects
  • Multi-cell HA is not a shipped product yet—launch scope is a hardened single cell
  • A provider that accepts then loses a request is reconciled, not magically prevented