ZZD public AI gateway · zzd_public_ai_gateway_v2
Resource: 10 · Authentication and safety / 风险边界
Canonical map: https://zzd.show/docs/ai/map.json
Full handbook: https://zzd.show/llms-full.txt

# Authentication and safety contract

## Available now: browser-first authorization

A third-party coding agent may operate the normal ZZD UI in a browser
the user controls. If the user is already signed in, the browser
sends the existing session automatically. The model must not read,
export, print, copy, request, or store cookies, session IDs, CSRF
tokens, passwords, payment data, private keys, or unrelated personal
information.

If sign-in is needed, let the user complete it. Do not ask the user
to paste a password or cookie into chat. UI mutations remain subject
to CSRF, ownership, rate, quota, visibility, and audit checks.

## External credentials

Never treat ZZD's legacy CLI secret as an MCP credential. A native
external tool transport should use user-created, scoped, expiring,
revocable credentials, optionally restricted to named Shows, with
mutation logs. Suggested future scopes are `shows:read`,
`shows:write`, `shows:publish`, `assets:write`, `baas:read`,
`baas:write`, and `sales:write`.

This public gateway is a read-only resource graph. It does not issue
credentials and does not claim that mutation tools already exist.
If the agent has no signed-in browser and no platform-issued scoped
credential, it must stop at a plan or guide the user through the UI.

## Require explicit confirmation

- publish, unpublish, or materially change access;
- submit, buy, remove, delete, or materially reprice a Sale;
- create, rotate, or revoke a credential;
- delete a Show, asset, BaaS collection, or user data;
- run a destructive BaaS migration;
- make a change that removes paid functionality or buyer access;
- send data to a new external party or enable sensitive permissions.

## Never expose or provide

- generic shell, SQL, staff, supervisor, container, or arbitrary
  target-binding access;
- ZZD deployment topology, keys, database schema/ORM recipes, worker
  queues, internal prompts, model routing, private evidence paths, or
  production algorithms;
- authentication bypass, privilege escalation, ownership bypass,
  rate-limit bypass, vulnerability exploitation, spam, scraping of
  private data, credential collection, or hidden beacons;
- raw private Piece/upload/prompt routes as a shortcut around access.

Operate only on resources the user owns or is authorized to change.
Use least privilege, redact tool output, return stable public IDs/URLs,
and keep an understandable change report.