> ## Documentation Index
> Fetch the complete documentation index at: https://www.agentworldprotocol.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Security

> TLS, authentication, session tokens, and the threat model.

* Connections on loopback or stdio — the common deployment — MAY be plaintext; any connection that leaves the machine MUST use TLS (`wss://`, gRPC over TLS). `[AWP-SEC-001]`
* Worlds MUST authenticate agents before `initialize` completes on any non-loopback connection; defined schemes: bearer token (`Authorization: Bearer`), mutual TLS. On stdio, process ownership stands in for authentication. On loopback, worlds SHOULD still require a bearer token — a local WebSocket port is reachable by every page in every browser on the machine, not just the intended agent tab. `[AWP-SEC-002]`
* `session.ready` returns an unguessable **session token** used for `session.resume` and for binding stream connections to the session. Tokens MUST be scoped to one session. `[AWP-SEC-003]`
* Stream endpoints MUST reject connections that do not present a valid session token. `[AWP-SEC-004]`

**Threat model (informative).** AWP assumes a potentially adversarial agent and a trusted world: all safety enforcement is world-side. A compromised world can feed false observations; agents operating in high-stakes settings SHOULD verify world identity (TLS pinning) and MAY cross-check observations against independent sensors.