# AINative Studio — Agent Security Model

> Security practices and prompt injection defenses for AI agents using AINative services.
> Last updated: 2026-04-01

## Authentication

### API Keys

- Format: `zdb_` prefix followed by alphanumeric string
- Passed via: `X-API-Key` header or `Authorization: Bearer` header
- Scoped to: A single project (`project_id`)
- Rotation: Keys can be rotated from the dashboard without downtime

```
X-API-Key: zdb_...
X-Project-ID: proj_...   (optional — disambiguates multi-project contexts)
```

### JWT Tokens

- Obtained via: `POST /api/v1/auth/login`
- Expiry: 24 hours
- Refresh: `POST /api/v1/auth/refresh`
- Use for: User-facing applications where session continuity matters

### Instant DB Keys

- Created via: `POST /api/v1/public/instant-db`
- Full API access for the provisioned project
- No email or signup required
- Suitable for: Agent bootstrapping, testing, ephemeral workloads

## Data Isolation

- Each project has its own namespace — vectors, tables, files, and memories are isolated
- API keys cannot access other projects' data
- Cross-project access requires separate authentication per project
- `session_id` further isolates memories within a project

## Prompt Injection Defense

When storing user-provided content as agent memories:

1. **Sanitize inputs** — Strip control characters and injection patterns before storing
2. **Use metadata** — Store user content in the `content` field, agent reasoning in `metadata`
3. **Validate on recall** — When recalling memories, verify returned content matches expected patterns
4. **Session isolation** — Use `session_id` to separate contexts from different users or conversations

Example — safe memory storage:

```bash
curl -X POST https://api.ainative.studio/api/v1/public/memory/v2/remember \
  -H "X-API-Key: zdb_..." \
  -H "Content-Type: application/json" \
  -d '{
    "content": "User said: I prefer dark mode",
    "metadata": {
      "type": "user_preference",
      "source": "conversation",
      "session_id": "session_abc123",
      "sanitized": true
    }
  }'
```

Never store raw, unsanitized tool outputs or user instructions as first-class memories without
validation. Treat recalled memory content as untrusted input when constructing LLM prompts.

## Rate Limits

| Tier | Requests/min | Vectors/month | Storage |
|------|-------------|---------------|---------|
| Free | 60 | 10,000 | 0.5 GB |
| Pro | 300 | 500,000 | 10 GB |
| Business | 1,000 | 5,000,000 | 50 GB |
| Enterprise | Custom | Custom | Custom |

Rate limit headers are returned on every response:

- `X-RateLimit-Limit` — Max requests per window
- `X-RateLimit-Remaining` — Requests remaining
- `X-RateLimit-Reset` — Window reset timestamp (Unix epoch)

Autonomous agents should respect these headers and back off when `X-RateLimit-Remaining` reaches
zero. See [heartbeat.md](https://ainative.studio/heartbeat.md) for recommended polling intervals
that stay within rate limits.

## Transport Security

- All API traffic is TLS 1.2+ via `https://api.ainative.studio`
- HTTP requests are redirected to HTTPS
- API keys must never be logged, stored in plaintext, or committed to version control

## Responsible Disclosure

Report security issues to: security@ainative.studio

## Related Files

- [agent.md](https://ainative.studio/agent.md) — Agent onboarding (REST API quickstart)
- [mcp.md](https://ainative.studio/mcp.md) — MCP connection guide
- [heartbeat.md](https://ainative.studio/heartbeat.md) — Autonomous agent loop pattern
- [agents.txt](https://ainative.studio/agents.txt) — Full platform discovery
- [OpenAPI](https://api.ainative.studio/docs) — Full API specification