# Authentication and access

> Vision uses narrowly scoped bearer credentials bound to audience, App entitlement, workspace, and granted scopes.

**Publication status:** development; not launched.

The accepted access design assigns credential control to tenant administrators. This development portal does not issue API keys, create integrations, or verify that credential-management UI is available.

Never place a service credential in browser code, public repositories, generated documentation, or AI prompts.

A documented operation can still be preview, restricted, acceptance-gated, or unavailable. Consult each App's runtime status.