Enterprise
Safe automation
Guidelines for using Sume APIs and tools from agents without leaking secrets or crossing workspace boundaries.
Use the public API, CLI, and MCP in a way that keeps each workspace isolated and keeps billing clear. Related: MCP tools and gates, CLI security.
Workspace isolation
The API key or the app session selects the workspace. Tools must not accept a workspace id from the user. The only exception is a product that explicitly supports a change between workspaces.
Credit-spending actions
Generation and analysis creation can spend credits. Agent tools must make those actions explicit. Agent tools must also keep read-only operations separate.
On hosted MCP, the best choice for read-only exploration is OAuth
mcp:read. Before you use paid tools such as generate_image, grant
mcp:write (or use an API key). Avatar tools such as avatars_create need an
API key on https://api.sume.com/mcp. Write calls and paid calls must send
idempotency_key. To cap a call, send max_spend_usd (dollars), and price it
first with dry_run: true. The legacy allow_write / allow_paid arguments
are optional.
Logging
Safe logs include:
- request ids,
- job ids when necessary,
- high-level status,
- sanitized media metadata.
Unsafe logs include:
- API keys,
- signed URLs,
- raw private media URLs,
- too much user content or too many transcripts.