Skip to main content
Conversation flows cross user, service, and project boundaries. User-scoped calls use bearer auth. Project-scoped operations also check membership, role, and resource access.

​
Boundaries

BoundaryCheck
Studio to APIBearer auth, then conversation or project permissions.
SSE run streamConversation access before replay or follow.
Project event notificationsProject access before subscription.
Studio to hosted agentBearer token authentication.
Hosted agent to APIForwarded bearer token for project and conversation operations.
API to project resourcesProject permissions and resource-specific access checks.

​
Rule

Use bearer auth for user-scoped API and agent calls. Veryfront applies project permission checks before exposing conversation, run, and event data.