10xGraphv1.0.0Search

    Security and access

    In this sectionAuthentication, roles, tenant isolation, rate limits, CORS, prompt-injection validators and audit logs for a 10xGraph server and its agents.

    • 8 pages
    • About 85 min to read all

    This section covers how to control access to a 10xGraph server and its agents: who can call it, what each role can see, how tenant data stays separate, and how requests are limited, screened and logged.

    • Authentication and roles: Enable JWT or custom auth, map roles to permissions, set how far each role can see, and keep every user’s data private in 10xGraph.
    • Permissions in tools: Read the caller’s identity and check permissions inside graph nodes and tools with get_identity, can and Identity.
    • Tenant isolation: Isolate organizations and projects in one Postgres with tenant columns on PgCheckpointer and PgVectorStore, set reach per role and filter your own columns.
    • Rate limiting: How to enable and configure the built-in sliding-window rate limiter in the 10xGraph API.
    • CORS and security headers: Configure cross-origin requests, security headers, request size limits, and trusted proxies.
    • Prompt-injection validators: How to validate and sanitize user input before it reaches your agent’s LLM, protecting against prompt injection, jailbreaks, and other OWASP LLM01:2025 attacks.
    • Audit log: Metadata-only JSON audit events for access, authentication failures and changes, how to configure sinks, ship the lines to storage, and what stays yours.

    All pages in Security and access

    Identity and roles

    1. Set up API authentication and authorizationEnable JWT or custom auth, map roles to permissions, set how far each role can see, and keep every user's data private in 10xGraph.18 min
    2. Authorization scopesRead the caller's identity and check permissions inside graph nodes and tools with get_identity, can and Identity.8 min
    3. Calling services as the userAuthenticate MCP servers and local tools as the current user with get_credential and mcp_auth: M2M, self-issued tokens or RFC 8693 token exchange.8 min

    Tenancy

    1. Multi-tenant dataIsolate organizations and projects in one Postgres with tenant columns on PgCheckpointer and PgVectorStore, set reach per role and filter your own columns.16 min

    Protect the server

    1. Configure Rate LimitingHow to enable and configure the built-in sliding-window rate limiter in the 10xGraph API.10 min
    2. CORS and security headersConfigure cross-origin requests, security headers, request size limits, and trusted proxies.8 min
    3. Validate input and guard promptsHow to validate and sanitize user input before it reaches your agent's LLM, protecting against prompt injection, jailbreaks, and other OWASP LLM01:2025 attacks.12 min

    Audit

    1. Audit logMetadata-only JSON audit events for access, authentication failures and changes, how to configure sinks, ship the lines to storage, and what stays yours.5 min