Human authority
Humans approve work, set policy, pause or resume activity, and create or revoke agent credentials.
Read authority docsSecurity & trust
Security starts with who is allowed to do what.
Postdom separates human authority, agent credentials, provider authorization, and execution paths so each actor stays inside its role.
Current public controlsVerified 29 August 2026
Enforced boundaries
Boundaries enforced in the product.
Workspace-scoped access
Agent credentials operate inside one workspace and role. Human-only routes reject agent credentials by design.
Inspect the contractSocial OAuth handoff
An agent may create an authorization URL. A human completes the provider flow outside agent context.
Read the handoffDirect media upload
Finished video uses a short-lived, workspace-scoped direct upload path and returns an opaque media handle.
Read upload docsSigned webhooks
Outbound webhooks use HMAC-SHA256 signatures. Receivers verify the raw body and reject stale timestamps.
Read webhook docsCredential lifecycle
Credential paths stay separate.
Agent credentials cannot exercise human approval routes.
- 01Human creates key
A human creates an agent credential with read or write scope in Accounts.
- 02Key shown once
The full credential and pinned configuration are shown once and are not retrieved again.
- 03Agent uses scoped access
The agent uses the credential only inside its granted workspace and scope.
- 04Human can revoke
A human can revoke the credential from Accounts when access should end.
- 01Agent creates authorization URL
The agent requests a provider authorization URL inside its workspace scope.
- 02Human opens provider flow
The account owner opens the URL and completes the provider's authorization flow.
- 03Provider returns connected account
Postdom receives the connected account state without the agent entering a password.
Social credentials never enter agent chat
Public status
What is public today.
Security documentation
This page and linked product documentation describe current enforced boundaries.
View documentationReporting channel
Postdom has not published a dedicated vulnerability-reporting channel.
General enquiryFAQ
Security questions.
Can agents access provider credentials?+
Agents may request an authorization URL, but a human completes the provider flow. Agents do not receive or enter the provider password, and credentials should never be pasted into agent chat.
Who can approve publishing actions?+
Human supervisors hold approval and policy authority. Agent credentials cannot exercise human approval routes, expand trust, change account policy, or approve the agent's own work.
How are webhooks verified?+
Postdom signs outbound webhook payloads with HMAC-SHA256. Receivers should verify the exact raw body with the event ID and timestamp, use a constant-time comparison, and reject stale timestamps.
Can I revoke an agent credential?+
Yes. A human can revoke workspace agent keys from the authenticated Accounts screen. Revoked credentials no longer resolve to workspace access.
How do I report a security issue?+
Postdom has not published a dedicated vulnerability-reporting channel. Use the general contact route for an initial enquiry, and do not include passwords, keys, signed upload URLs, or provider tokens.