# Secure the appliance

Protect who can call a surface, who can administer the appliance itself, and the credentials it holds on your behalf. Field-level reference for every mechanism here is in [Source authentication →](/products/affinidi-trust-fabric/agent-stream/reference/security/source-authentication.md), [Secrets →](/products/affinidi-trust-fabric/agent-stream/reference/security/secrets.md), and [RBAC →](/products/affinidi-trust-fabric/agent-stream/reference/security/rbac.md).

| Guide | What you will achieve |
| [Validate bearer tokens on a surface](/products/affinidi-trust-fabric/agent-stream/how-to-guides/security/validate-bearer-tokens-on-a-surface.md) | Create a JWT verification strategy and attach it to a surface so only callers with a valid, correctly issued token can reach it. |
| [Rotate provider credentials without downtime](/products/affinidi-trust-fabric/agent-stream/how-to-guides/security/rotate-provider-credentials-without-downtime.md) | Point a surface’s LLM node at a new secret holding the new provider credential, confirm it works, then retire the old secret, so every surface keeps working while you rotate. |
| [Limit dashboard actions with RBAC roles](/products/affinidi-trust-fabric/agent-stream/how-to-guides/security/limit-dashboard-actions-with-rbac-roles.md) | Assign the Administrator, Power User, or User role to a dashboard account so it can only perform the actions its job requires. |
| [Require terms acceptance before dashboard access](/products/affinidi-trust-fabric/agent-stream/how-to-guides/security/require-terms-before-dashboard-access.md) | Publish your organisation’s terms and conditions from the T&C Manager, so every dashboard user accepts them at sign-in, and ask existing users to accept again when a new version is published. |

## Pages in this section
- [Validate bearer tokens on a surface](/products/affinidi-trust-fabric/agent-stream/how-to-guides/security/validate-bearer-tokens-on-a-surface.md): Create a JWT verification strategy and attach it to a surface's source authentication so only callers with a valid, correctly issued token can reach it.
- [Rotate provider credentials without downtime](/products/affinidi-trust-fabric/agent-stream/how-to-guides/security/rotate-provider-credentials-without-downtime.md): Point a surface's LLM node at a new secret holding the new provider credential, confirm it works, then retire the old secret, so every surface keeps working while you rotate.
- [Limit dashboard actions with RBAC roles](/products/affinidi-trust-fabric/agent-stream/how-to-guides/security/limit-dashboard-actions-with-rbac-roles.md): Assign the Administrator, Power User, or User role to a dashboard account so it can only perform the actions its job requires.
- [Require terms acceptance before dashboard access](/products/affinidi-trust-fabric/agent-stream/how-to-guides/security/require-terms-before-dashboard-access.md): Publish your organisation's terms and conditions from the T&C Manager, so every dashboard user accepts them at sign-in, and ask existing users to accept again when a new version is published.