Auth Enforcement
Ensures all messages come from authorized channels and verified users.
This guard is primarily relevant to administrators managing which channels and users can access your agents. In most deployments, this is configured once during setup and rarely needs adjustment.
What It Does
Before any message reaches your agent, Auth Enforcement checks two things: is this channel authorized to send messages, and is this user allowed to use it? It's a simple but critical gate — if the channel isn't configured or the user isn't recognized, the message is blocked before any other guard even sees it.
Think of it as the front door lock. No matter how sophisticated your interior security is, none of it matters if anyone can walk in off the street. Auth Enforcement makes sure only the right people get through the door in the first place.
Why It Matters
Without authentication enforcement, anyone who discovers your agent's endpoint could send it messages. This could lead to unauthorized use of your agent's capabilities, exposure of sensitive information, or abuse of connected services. Auth Enforcement is the foundation that every other security layer builds on — it ensures that only authorized users through approved channels can interact with your agents.
What Gets Caught
- Unconfigured channels — messages arriving from channels that haven't been set up in CrabShack
- Unauthorized users — if a user allowlist is configured, messages from users not on the list
- Unauthenticated requests — messages that don't include valid authentication
What won't trigger it: Messages from configured channels sent by authenticated (and allowlisted, if applicable) users. If a legitimate channel is being blocked, make sure it's been properly configured in CrabShack.
Example
A message arrives from a channel that hasn't been configured in CrabShack. Auth Enforcement checks the channel against the list of approved channels and finds no match. The message is silently rejected — the agent never sees it and no response is sent. The audit log records an unconfigured_channel event with the channel identifier and timestamp. If a legitimate new channel needs access, an administrator configures it in the CrabShack dashboard.
Settings
| Setting | What It Controls |
|---|---|
| Require Authentication | Whether to enforce authentication on all messages |
| Block Unconfigured Channels | Whether to reject messages from channels that haven't been set up |
| User Allowlist | Restrict access to specific user accounts |
How It Responds
Unauthorized messages are silently rejected. There are no modes — authentication is either required or it isn't. Rejected messages are logged but no response is sent to the sender.
If This Guard Blocks You
-
Check the audit log. Navigate to Security > Audit Log in the CrabShack dashboard. Filter by Auth Enforcement to find the relevant event. Click on the event row to expand it and see details including which skill and channel triggered it, the session key, and additional context.
-
Understand the detection. The audit log shows the reason —
unconfigured_channel(the message came from a channel not set up in CrabShack),unauthorized_user(the user isn't on the allowlist), orunauthenticated(the request didn't include valid authentication). If a legitimate channel is being blocked, make sure it has been properly configured in the CrabShack dashboard. If a user is being blocked, check whether a user allowlist is configured and whether the user is on it. -
Adjust if needed. Configure new channels in the CrabShack dashboard. Add users to the allowlist if one is configured. This guard doesn't have modes — authentication is either required or it isn't. See the Configuration page for details.
Prefer creating a targeted exemption for a specific skill or channel over disabling the guard entirely. If you're seeing frequent false positives, a suppression lets you silence a specific detection label temporarily while you refine your settings.
Default Behavior
Authentication is required. Unconfigured channels are blocked.
Related Guards
- Input Validator — enforces message size and rate limits after authentication passes, providing the next layer of input validation.
- Audit & Alerts — logs all rejected authentication attempts for security monitoring and compliance.