> ## Documentation Index
> Fetch the complete documentation index at: https://docs.axon402.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Security

> Security controls and hardening checklist

## Secret Boundary

* The OpenClaw plugin does **not** hold signing secrets
* The Decision daemon process holds sensitive material:
  * `SUPABASE_SERVICE_KEY`
  * `MASTER_MNEMONIC` / signer context
  * `AXON_DECISION_API_KEY` (when static operator auth is enabled)
  * `AXON_API_KEY_HASH_PEPPER`
  * `AXON_SECRETS_KEY`
  * `AXON_PROVIDER_SEARCH_FEEDBACK_SIGNING_KEY` (when feedback publishing is enabled)

## Deterministic Policy Gates

Before settlement, AXON enforces:

* Wallet active check
* Mandate presence
* Idempotency duplicate check
* Host/path allow/block checks
* Task metadata requirement (`require_task_metadata`)
* Per-transaction / daily / monthly spend limits (`mandate.monthly_limit_usdc`)
* Per-minute rate limits (`mandate.max_requests_per_minute`)
* Per-minute spend caps (`mandate.max_spend_per_minute_usdc`)
* Network validation (`mandate.networks` whitelist)
* Per-task/per-host 402 retry budget

## LLM Alignment Scoring

When `AXON_ALIGNMENT_LLM_ENABLED=true`, alignment evaluation uses an external LLM for semantic scoring instead of the default structural (Jaccard) scorer. The LLM scorer falls back to Jaccard on failure or timeout. LLM calls are subject to `AXON_ALIGNMENT_LLM_TIMEOUT_MS`.

## Provider Identity Controls

* Provider registry match on host + path (+ optional network/asset)
* Challenge attestation checks for destination/network/asset consistency
* Strict mode via `AXON_REQUIRE_PROVIDER_REGISTRY=true`
* Default posture is soft mode

## Risk & Approval Controls

* Risk scoring with escalation thresholds
* Human approval required for escalated requests
* Approval tokens are:
  * Short-lived (default 5 minutes)
  * Request-scoped (wallet/host/path/method/idempotency)
  * Single-consume (`consumed_at` guard)

## Runtime Abuse Controls

| Control | Configuration |
| :- | :- |
| Request-per-minute rate limit | `max_requests_per_minute` |
| Per-minute spend cap | `max_spend_per_minute_usdc` |
| Host circuit breaker | `AXON_CIRCUIT_FAILURE_THRESHOLD` (default 3) |
| Paid-gateway origin timeout | `AXON_MANAGED_GATEWAY_TIMEOUT_MS` |
| JSON payload size cap | 256kb |

## Current Launch Constraints

* Rate limiting state is process-local. Horizontal scale increases total effective throughput unless you add an external limiter.
* Circuit-breaker state is process-local. One instance opening a circuit does not pause peer instances.
* The public launch docs assume USDC on Base. Other networks should be treated as non-GA.

## Forensic Integrity

* Canonical spend request + decision + receipt persistence
* Signed webhook delivery (`X-AXON-SIGNATURE`, HMAC-SHA256)
* Claim/lease outbox dispatch (no duplicate delivery)
* Dead-letter status after max webhook attempts

## Hardening Checklist

> [!TIP]
>
> Restrict Decision daemon network exposure

> [!TIP]
>
> Rotate `AXON_DECISION_API_KEY` and infrastructure secrets

> [!TIP]
>
> Keep `SUPABASE_SERVICE_KEY` and signer material out of logs/transcripts

> [!TIP]
>
> Set `AXON_MCP_PUBLIC_URL` in live deployments so onboarding snippets never derive from caller-controlled Host headers

> [!TIP]
>
> Monitor denial/escalation reason-code trends

> [!TIP]
>
> Enable and monitor webhook dead-letter queue

> [!TIP]
>
> Verify `user_organizations` isolation with a second test account

> [!TIP]
>
> Ensure `SUPABASE_SERVICE_KEY` is never used in the frontend

> [!TIP]
>
> Verify the daemon refuses to start when both static operator auth and platform auth are absent


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.