# Security & Access

| Reference | What it covers |
| [Secrets](/products/affinidi-trust-fabric/agent-stream/reference/security/secrets.md) | Secret record fields, value disclosure rules, and create/update/delete lifecycle. |
| [API keys](/products/affinidi-trust-fabric/agent-stream/reference/security/api-keys.md) | The API Keys tab: managed API key record fields, status values, and rotation behaviour. |
| [Source authentication](/products/affinidi-trust-fabric/agent-stream/reference/security/source-authentication.md) | The four ways a surface can authenticate its callers (JWT Bearer, API Key (secret store), API Key (provider), and mTLS), and where each method’s values come from. |
| [RBAC](/products/affinidi-trust-fabric/agent-stream/reference/security/rbac.md) | The Administrator, Power User, and User role ladder and the full default permission map. |

## Pages in this section
- [Secrets](/products/affinidi-trust-fabric/agent-stream/reference/security/secrets.md): Field reference for the secrets store, record fields, value disclosure rules, and lifecycle operations.
- [API keys](/products/affinidi-trust-fabric/agent-stream/reference/security/api-keys.md): Field reference for the API Keys tab on the Secrets page, covering key record fields, status values, and rotation.
- [Source authentication](/products/affinidi-trust-fabric/agent-stream/reference/security/source-authentication.md): Field reference for the JWT Bearer, API Key (secret store), API Key (provider), and mTLS methods a surface uses to authenticate its callers.
- [RBAC](/products/affinidi-trust-fabric/agent-stream/reference/security/rbac.md): Field reference for role-based access control, the role ladder and the full default permission map enforced across the dashboard.