# The SmythOS Runtime Environment (SRE) is designed with security at its core.

Every operation, agent execution, resource access, or collaboration, is protected by a security model that includes zero-trust access control, vault-backed secret management, and real-time role enforcement.

## Security by Default

Every request in SRE is checked against role-based permissions and access policies. Only verified candidates with the correct role and explicit access can read, write, or execute.

## Identity Enforcement with Candidates and ACLs

SRE enforces access at the identity level using the **Candidate and ACL model**:

- A `Candidate` is any identity in the system -> an agent, user, or even a specific process.
- An **Access Control List (ACL)** defines what actions each candidate can perform.

Every time a candidate attempts to access a resource, such as storage or an LLM, SRE checks the ACL for explicit permission.

```javascript
const candidate = AccessCandidate.agent(agentId);
const storage = ConnectorService.getStorageConnector().user(candidate);
await storage.write('results.json', data);
```

You can manage these permissions through [Roles and Permissions](/content/docs/account-management/user-management/index.html), and they are enforced consistently across [Spaces](/content/docs/agent-collaboration/spaces/index.html) and your [Organization](/content/docs/account-management/organization-management/index.html).

## Vault-Based Secret Management

Sensitive data, like API keys, credentials, and tokens, is never hardcoded or exposed. Instead, SRE uses the [Vault](/content/docs/agent-studio/key-concepts/vault/index.html) subsystem for secure, encrypted secret storage.

- Vaults encrypt all data at rest and in transit.
- You can use built-in vaults or external providers, including AWS Secrets Manager and HashiCorp Vault.
- Role-based access ensures only approved agents or users can access specific secrets.
- Every secret access is logged for compliance and traceability.

To manage secrets, visit the [Vault dashboard](/content/docs/agent-studio/key-concepts/vault/index.html).

## Authentication and Identity Providers

SRE supports both built-in authentication and integration with external enterprise systems:

- Connect with enterprise SSO or LDAP.
- Add [custom account connectors](/content/docs/agent-runtime/sdk-guide/index.html) to fit your organization’s authentication workflows.
- Use token-based login for programmatic or API access.

You can manage users and authentication settings from the [Organization Management panel](/content/docs/account-management/organization-management/index.html).

## Role-Based Access Control (RBAC)

Role-based access control is central to SRE. Roles define **who can do what**... from the agent runtime to your admin dashboard, and are enforced in real time.

- **Organization-wide roles:** e.g., Super Admin
- **Space-specific roles:** e.g., Admin, Editor, Viewer

If a candidate does not have the correct permissions, the action is denied before execution.

To adjust or review roles, see the [Roles and Permissions guide](/content/docs/account-management/user-management/index.html).

## Enterprise Security Features

SRE is built to support production and regulated environments:

- **TLS/SSL encryption** across all internal and external communication.
- **Audit logs** for every critical operation (agent runs, data access, vault usage).
- **Vault secrets** can be rotated and revoked automatically.
- **Least privilege policies** since unknown or unconfigured actions are denied by default.

To learn more about deploying SRE in enterprise settings, see [Enterprise Deployment](/content/docs/agent-runtime/enterprise-deployment/index.html).

## Review Policies Regularly

Security is a shared responsibility. Review your ACLs, vault settings, and audit logs periodically to maintain compliance and minimize risk.

## How SRE Security Connects

SRE security spans multiple subsystems. Here’s where to manage each area:

| Security Area | Where It’s Managed |
| --- | --- |
| Identity & ACLs | [Roles and Permissions](/content/docs/account-management/user-management/index.html) |
| Credential Storage | [Vault](/content/docs/agent-studio/key-concepts/vault/index.html) |
| User Roles & Login | [Organization Management](/content/docs/account-management/organization-management/index.html) |
| Agent Environments | [Spaces](/content/docs/agent-collaboration/spaces/index.html) |
| Advanced Deployment | [Enterprise Deployment](/content/docs/agent-runtime/enterprise-deployment/index.html) |

## What’s Next?

- [Roles and Permissions](/content/docs/account-management/user-management/index.html)
- [Organization Management](/content/docs/account-management/organization-management/index.html)
- [Spaces Overview](/content/docs/agent-collaboration/spaces/index.html)
- [Enterprise Deployment](/content/docs/agent-runtime/enterprise-deployment/index.html)
- [Architecture Overview](/content/docs/agent-runtime/architecture/index.html)