## Scope

- API keys are Workspace-scoped.
- Configured agents are found or created inside the selected Workspace.
- Sessions and returned files belong to the Workspace that served the runtime task.
- A missing configured agent can mean the key was created from a different Workspace.

## Product records

Your product should still keep its own user, tenant, feature, session, response, and artifact records. Do not expose account-wide Workspace session listings directly to end users.

**Open standard**

Workspace-scoped keys, configured agents, sessions, and returned files are HarnessRouter's implementation of UHP's object-scope rule: every object belongs to the principal whose credential created it, on every operation. See [Security considerations in the Unified Harness Protocol](https://unifiedharnessprotocol.org/spec/security).