Auth Governance And Compliance

Operator uses one Patronus API key across local laptops, CI, and production, with no scoping or per-environment separation.

Issue separate API keys per environment (dev / CI / prod) with the minimum scope each needs, so a leaked CI key cannot touch production data and can be revoked in isolation. Never embed keys in client-side bundles. [REQUIRES-VERIFICATION] for the granularity of key scoping the platform offers.

A contractor leaves the team. Their Patronus API key is never rotated and remains valid months later.

Rotate and revoke API keys on a cadence and on personnel change: revoke the departed contractor's key immediately, confirm the old key is dead, and audit key creation/usage. Manage rotation in a secret manager rather than by hand. Treat a stale valid key as standing risk.

Operator sends the entire conversation history plus internal system metadata to the evaluator when only the latest answer and its context are being judged.

Send the evaluator only the fields it needs for the judgment (input, output, relevant context) and strip unrelated internal metadata and unnecessary history. Minimizing the payload reduces exposure, cost, and the chance of leaking secrets or PII that the evaluation did not require.