Learn Academy
Worker sessions stay on the server
Policies show rooftop runtime rules. Requesting a worker session never returns a vault token or CA to this desk.
Open Policies at /agentos/policies. The list is not a settings page. HITL send, HITL publish, no plaintext keys, no browser session material, vault fail-closed, blocked worker egress, and SSRF-safe model URLs stay enforced.
Request worker session records a handle for an agent on this rooftop. If Agent Vault is not live, the request is denied and the reason stays on the row. A minted handle means the orchestrator held the session material on the server. This page never shows the token, proxy env, or CA material.
Seed and demo desks stay fail-closed unless AGENT_VAULT_ALLOW_DEV_ADMIN is set for a local administrator. autoSend stays false. A worker session is not a customer send and does not publish a listing.
Check Tokens if usage is held — a cap blocks mint the same way it blocks cloud completions. Review Providers and Models before asking the vault to mint.