# Security & Access

| Reference | What it covers |
| [Secrets](/products/affinidi-trust-fabric/agent-stream/reference/security/secrets.md) | Secret record fields, value disclosure rules, storage backends, and create/update/delete lifecycle. |
| [API keys](/products/affinidi-trust-fabric/agent-stream/reference/security/api-keys.md) | Managed API key record fields, status values, expiry and rotation behaviour, and use as a source-auth credential. |
| [Source authentication](/products/affinidi-trust-fabric/agent-stream/reference/security/source-authentication.md) | The four ways a surface can authenticate its callers — JWT bearer, API key, API Key Provider, and mTLS — and where each method’s values come from. |
| [RBAC](/products/affinidi-trust-fabric/agent-stream/reference/security/rbac.md) | The administrator/poweruser/user role ladder and the full default permission map. |

## Pages in this section
- [Secrets](/products/affinidi-trust-fabric/agent-stream/reference/security/secrets.md): Field reference for the secrets store, record fields, value disclosure rules, storage backends, and lifecycle operations.
- [API keys](/products/affinidi-trust-fabric/agent-stream/reference/security/api-keys.md): Field reference for managed API keys, record fields, status, expiry, rotation, and use as a source-authentication credential.
- [Source authentication](/products/affinidi-trust-fabric/agent-stream/reference/security/source-authentication.md): Field reference for the JWT bearer, API key, API Key Provider, and mTLS methods a surface uses to authenticate its callers.
- [RBAC](/products/affinidi-trust-fabric/agent-stream/reference/security/rbac.md): Field reference for role-based access control, the role ladder and the full default permission map enforced across the dashboard and management API.