# Secure the appliance

Protect who can call a surface, who can administer the appliance itself, and the credentials it holds on your behalf. Field-level reference for every mechanism here is in [Source authentication →](/products/affinidi-trust-fabric/agent-stream/reference/security/source-authentication.md), [Secrets →](/products/affinidi-trust-fabric/agent-stream/reference/security/secrets.md), and [RBAC →](/products/affinidi-trust-fabric/agent-stream/reference/security/rbac.md).

| Guide | What you will achieve |
| [Validate bearer tokens on a surface](/products/affinidi-trust-fabric/agent-stream/how-to-guides/security/validate-bearer-tokens-on-a-surface.md) | Create a JWT verification strategy and attach it to a surface so only callers with a valid, correctly issued token can reach it. |
| [Rotate provider credentials without downtime](/products/affinidi-trust-fabric/agent-stream/how-to-guides/security/rotate-provider-credentials-without-downtime.md) | Update a stored secret’s value in place so every surface referencing it picks up the new credential on its next request, with no surface reconfiguration. |
| [Limit dashboard actions with RBAC roles](/products/affinidi-trust-fabric/agent-stream/how-to-guides/security/limit-dashboard-actions-with-rbac-roles.md) | Assign the administrator, poweruser, or user role to a dashboard account so it can only perform the actions its job requires. |

## Pages in this section
- [Validate bearer tokens on a surface](/products/affinidi-trust-fabric/agent-stream/how-to-guides/security/validate-bearer-tokens-on-a-surface.md): Create a JWT verification strategy and attach it to a surface's source authentication so only callers with a valid, correctly issued token can reach it.
- [Rotate provider credentials without downtime](/products/affinidi-trust-fabric/agent-stream/how-to-guides/security/rotate-provider-credentials-without-downtime.md): Point a surface's LLM node at a new secret holding the new provider credential, confirm it works, then retire the old secret, so every surface keeps working while you rotate.
- [Limit dashboard actions with RBAC roles](/products/affinidi-trust-fabric/agent-stream/how-to-guides/security/limit-dashboard-actions-with-rbac-roles.md): Assign the administrator, poweruser, or user role to a dashboard account so it can only perform the actions its job requires.