Reframe auth docs around two integration paths

[AnnaXWang]

summary

• turn the Auth overview into a decision page for Managed Auth and Vaults + Credential Fill
• move the existing Managed Auth tutorial to its own page and add a Vaults + Credential Fill overview
• reorganize navigation, clarify credential terminology, and retarget Managed Auth links across the docs

validation

• PUPPETEER_SKIP_DOWNLOAD=true npx --yes mintlify@latest validate
• PUPPETEER_SKIP_DOWNLOAD=true npx --yes mintlify@latest broken-links
• rendered all affected entry points in the local Mintlify preview

---

Note

Low Risk
Documentation-only changes (navigation, copy, and link targets); no runtime or API behavior changes.

Overview
Reframes the Auth docs around two integration paths: Vaults + Credential Fill (your app/agent owns login) versus Managed Auth (KERNEL runs login and session recovery).

/auth/overview becomes a decision page with a comparison table, use cases, and security boundaries. The former Managed Auth walkthrough moves to /auth/managed-auth, and /auth/credential-fill adds a step-by-step overview for vault attach, collection, and fill. Navigation in docs.json splits Auth into nested groups, adds vaults/existing-credential-vault, and redirects old /auth/overview / agent paths to /auth/managed-auth.

Shared cookbook steps are extracted into snippets/* and reused in the credential-fill guide and use-vault-credentials-in-browser-agent. Cross-doc links that pointed at /auth/overview now target /auth/managed-auth.

Managed Auth pages are tightened to describe eligible automatic reauthentication (not guaranteed), email/SMS needing a new interactive login, clearer health_checks / auto_reauth behavior, React NEEDS_AUTH handoff, and renamed Managed Auth Credentials terminology. Vault docs tie fill to the credential-fill path and document copying from an existing vault.

^{Reviewed by Cursor Bugbot for commit 261e67e. Bugbot is set up for automated code reviews on this repo. Configure here.}

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated
Kernel	🟢 Ready	View Preview	Sep 16, 2026, 2:45 AM

💡 Tip: Enable Automations to automatically generate PRs for you.

[cursor]

Stale comment

Risk assessment: Very Low

Re-evaluated after the latest push (31721b59). Risk is unchanged from the prior Very Low approval, so that approval stands and is not being dismissed or re-issued.

This PR still only changes Mintlify documentation and site navigation. The 22-file diff is .mdx content plus docs.json sidebar/redirect updates. There is no application code, CI, infrastructure, schema, or auth/permissions logic change.

Evidence

• New/rewritten pages (auth/overview.mdx, auth/managed-auth.mdx, auth/credential-fill.mdx) are user-facing docs and examples, not executable product code.
• Remaining files are link retargets, titles, and changelog URL updates after the Managed Auth tutorial moved to /auth/managed-auth.
• docs.json reorganizes the Auth sidebar and updates one redirect (/auth/agent/overview → /auth/managed-auth).
• The post-approval delta is 7 lines in auth/overview.mdx and docs.json: it restores the shared Vaults pages to their original sidebar group and retargets one overview card. That reduces navigation blast radius; it does not add production logic.
• No CODEOWNERS file.

Blast radius: docs site copy and navigation only. Incorrect guidance would affect readers, not production systems.

Decision: Very Low. Existing approval remains.

  

_{Sent by Cursor Automation: Assign PR reviewers}

[cursor]

Stale comment

Risk assessment: Very Low

Re-evaluated after the latest push (b11778a5). Risk is unchanged from the prior Very Low approval, so that approval stands and is not being dismissed or re-issued.

This PR still only changes Mintlify documentation and site navigation. The 22-file diff is .mdx content plus docs.json sidebar/redirect updates. There is no application code, CI, infrastructure, schema, or auth/permissions logic change.

Evidence

• New/rewritten pages (auth/overview.mdx, auth/managed-auth.mdx, auth/credential-fill.mdx) are user-facing docs and examples, not executable product code.
• Remaining files are link retargets, titles, and changelog URL updates after the Managed Auth tutorial moved to /auth/managed-auth.
• docs.json reorganizes the Auth sidebar and updates one redirect (/auth/agent/overview → /auth/managed-auth).
• The post-approval delta since the last assessment is a cookbook cross-link and one vault link in auth/credential-fill.mdx, plus a wording tweak in browsers/use-vault-credentials-in-browser-agent.mdx. That does not add production logic or widen blast radius.
• No CODEOWNERS file.

Blast radius: docs site copy and navigation only. Incorrect guidance would affect readers, not production systems.

Decision: Very Low. Existing approval remains.

  

_{Sent by Cursor Automation: Assign PR reviewers}

[cursor]

Stale comment

Risk assessment: Very Low

Re-evaluated the current HEAD (b11778a). Risk remains Very Low. The existing approval from an earlier commit stands and is not being dismissed or re-issued.

Evidence (from the diff, not the PR description)

• 22 files: 21 .mdx pages plus docs.json. No application code, CI, infrastructure, schema, or runtime auth/permissions logic.
• New/rewritten pages (auth/overview.mdx, auth/managed-auth.mdx, auth/credential-fill.mdx) are Mintlify docs and SDK examples. auth/managed-auth.mdx is the prior overview tutorial moved to its own URL.
• Remaining edits are title/link retargets after /auth/overview became a decision page and Managed Auth moved to /auth/managed-auth.
• docs.json only reorganizes the Auth sidebar and updates one redirect (/auth/agent/overview → /auth/managed-auth).
• No CODEOWNERS file, so codeowner review is not required.

Blast radius: docs-site copy and navigation only. Incorrect guidance or a broken link would affect readers, not production systems.

Decision: Very Low. Already approved; no re-approval.

  

_{Sent by Cursor Automation: Assign PR reviewers}

[cursor]

Stale comment

Risk assessment: Very Low

Re-evaluated after the latest push (97205569). Risk is unchanged from the prior Very Low approval, so that approval stands and is not being dismissed or re-issued.

Evidence (from the diff, not the PR description)

• 23 files: 22 .mdx pages plus docs.json. No application code, CI, infrastructure, schema, or runtime auth/permissions logic.
• New/rewritten pages (auth/overview.mdx, auth/managed-auth.mdx, auth/credential-fill.mdx, auth/credential-fill/existing-vault.mdx) are Mintlify docs and SDK examples. auth/managed-auth.mdx is the prior overview tutorial moved to its own URL.
• Remaining edits are title/link retargets after /auth/overview became a decision page and Managed Auth moved to /auth/managed-auth.
• docs.json only reorganizes the Auth sidebar and updates one redirect (/auth/agent/overview → /auth/managed-auth).
• The post-approval delta since the last assessment is a new docs page (auth/credential-fill/existing-vault.mdx) plus a sidebar entry and two cross-links. That does not add production logic or widen blast radius beyond the docs site.
• No CODEOWNERS file, so codeowner review is not required.

Blast radius: docs-site copy and navigation only. Incorrect guidance or a broken link would affect readers, not production systems.

Decision: Very Low. Already approved; no re-approval.

  

_{Sent by Cursor Automation: Assign PR reviewers}

[cursor]

Stale comment

Risk assessment: Very Low

Re-evaluated after the latest push (f6c33e39). Risk is unchanged from the prior Very Low approval, so that approval stands and is not being dismissed or re-issued.

Evidence (from the diff, not the PR description)

• 24 files: 23 .mdx pages plus docs.json. No application code, CI, infrastructure, schema, or runtime auth/permissions logic.
• New/rewritten pages (auth/overview.mdx, auth/managed-auth.mdx, auth/credential-fill.mdx, vaults/existing-credential-vault.mdx) are Mintlify docs and SDK examples. auth/managed-auth.mdx is the prior overview tutorial moved to its own URL.
• Remaining edits are title/link retargets after /auth/overview became a decision page and Managed Auth moved to /auth/managed-auth.
• docs.json only reorganizes the Auth/Vaults sidebars and updates redirects (/auth/agent/overview → /auth/managed-auth, plus /auth/credential-fill/existing-vault → /vaults/existing-credential-vault).
• The post-approval delta since the last assessment is a docs page rename (auth/credential-fill/existing-vault.mdx → vaults/existing-credential-vault.mdx), a matching redirect, sidebar move into the Vaults group, and copy/link updates. That does not add production logic or widen blast radius beyond the docs site.
• No CODEOWNERS file, so codeowner review is not required.

Blast radius: docs-site copy and navigation only. Incorrect guidance or a broken link would affect readers, not production systems.

Decision: Very Low. Already approved; no re-approval.

  

_{Sent by Cursor Automation: Assign PR reviewers}

[masnwilliams]

The overall two-path framing is right, but the chooser currently uses credential ownership as the primary distinction. That will misroute an important Managed Auth use case: an end user provides credentials during setup, then KERNEL maintains authentication for later unattended work.

The core split should be:

• Vaults + Credential Fill: a user is present during the browser task, and the customer's application or agent owns the login flow.
• Managed Auth: KERNEL owns the login lifecycle, particularly when work happens after the user leaves.

Please apply that distinction consistently across the cards, comparison table, use-case lists, and Managed Auth cross-link. Credential source/ownership can remain a secondary consideration, but it should not define the two paths.

Two non-blocking maintainability notes:

• vaults/existing-credential-vault.mdx duplicates much of the canonical credential-item example and lifecycle guidance from vaults/credentials.mdx. Keeping one canonical implementation or extracting a reusable snippet would reduce future drift.
• The Credential Fill overview should explicitly state that Fill does not discover fields, navigate, submit, verify authentication, monitor the session, or reauthenticate. The current text implies most of this, but the capability boundary should be unmistakable on a page intended to help readers choose the correct path.

[AnnaXWang]

The overall two-path framing is right, but the chooser currently uses credential ownership as the primary distinction. That will misroute an important Managed Auth use case: an end user provides credentials during setup, then KERNEL maintains authentication for later unattended work.

The core split should be:

• Vaults + Credential Fill: a user is present during the browser task, and the customer's application or agent owns the login flow.
• Managed Auth: KERNEL owns the login lifecycle, particularly when work happens after the user leaves.

Please apply that distinction consistently across the cards, comparison table, use-case lists, and Managed Auth cross-link. Credential source/ownership can remain a secondary consideration, but it should not define the two paths.

Two non-blocking maintainability notes:

• vaults/existing-credential-vault.mdx duplicates much of the canonical credential-item example and lifecycle guidance from vaults/credentials.mdx. Keeping one canonical implementation or extracting a reusable snippet would reduce future drift.
• The Credential Fill overview should explicitly state that Fill does not discover fields, navigate, submit, verify authentication, monitor the session, or reauthenticate. The current text implies most of this, but the capability boundary should be unmistakable on a page intended to help readers choose the correct path.

I will make some edits, thanks!

Worth calling out that the distinction isn't accurate as written here:

• "KERNEL maintains authentication for later unattended work." - I will clarify this as "automatically attempts background reauthentication for eligible flows".
• Vaults + Credential Fill: a user is present during the browser task - the user doesn't have to be present, we just need their credentials in the vault

[cursor]

Stale comment

Risk assessment: Very Low

Re-evaluated after the latest push (1e569844). Risk is unchanged from the prior Very Low approval, so that approval stands and is not being dismissed or re-issued.

Evidence (from the diff, not the PR description)

• 24 files: 23 .mdx pages plus docs.json. No application code, CI, infrastructure, schema, or runtime auth/permissions logic.
• New/rewritten pages (auth/overview.mdx, auth/managed-auth.mdx, auth/credential-fill.mdx, vaults/existing-credential-vault.mdx) are Mintlify docs and SDK examples. auth/managed-auth.mdx is the prior overview tutorial moved to its own URL.
• Remaining edits are title/link retargets after /auth/overview became a decision page and Managed Auth moved to /auth/managed-auth.
• docs.json only reorganizes the Auth/Vaults sidebars and updates redirects (/auth/agent/overview → /auth/managed-auth, plus /auth/credential-fill/existing-vault → /vaults/existing-credential-vault).
• The post-approval delta since the last assessment is documentation copy only: use-case lists, Credential Fill capability notes, Managed Auth reauth wording, and replacing duplicated vault examples with links to the canonical credentials page. That narrows docs content; it does not add production logic or widen blast radius.
• No CODEOWNERS file, so codeowner review is not required.

Blast radius: docs-site copy and navigation only. Incorrect guidance or a broken link would affect readers, not production systems.

Decision: Very Low. Already approved; no re-approval.

  

_{Sent by Cursor Automation: Assign PR reviewers}

[akxue]

i think there are two concepts here, the product concept and the specific API call

i think we aren't super consistent or clear (even just marking the api operation with fill consistently)

[akxue]

just noticed we dont have code examples like we do for managed auth section, is that something we could add?

[AnnaXWang]

done!

[akxue]

this is existing already, but i wonder if introducing can_reauth and NEEDS_AUTH here might be confusing, since this is before the reader undersatnds lifecycle or api fields

maybe we shoudl explain in plain language only here andn then defer exact field/status to the in-depth section

[cursor]

Stale comment

Risk assessment: Very Low

Re-evaluated after the latest push (394d2748). Risk is unchanged from the prior Very Low approval, so that approval stands and is not being dismissed or re-issued.

Evidence (from the diff, not the PR description)

• 24 files: 23 .mdx pages plus docs.json. No application code, CI, infrastructure, schema, or runtime auth/permissions logic.
• New/rewritten pages (auth/overview.mdx, auth/managed-auth.mdx, auth/credential-fill.mdx, vaults/existing-credential-vault.mdx) are Mintlify docs and SDK examples. auth/managed-auth.mdx is the prior overview tutorial moved to its own URL.
• Remaining edits are title/link retargets after /auth/overview became a decision page and Managed Auth moved to /auth/managed-auth.
• docs.json only reorganizes the Auth/Vaults sidebars and updates redirects (/auth/agent/overview → /auth/managed-auth, plus /auth/credential-fill/existing-vault → /vaults/existing-credential-vault).
• The post-approval delta since the last assessment is comparison-table copy in auth/overview.mdx (dropped the best for row, reordered where login happens, and reworded example use cases). That is documentation wording only; it does not add production logic or widen blast radius.
• No CODEOWNERS file, so codeowner review is not required.

Blast radius: docs-site copy and navigation only. Incorrect guidance or a broken link would affect readers, not production systems.

Decision: Very Low. Already approved; no re-approval.

  

_{Sent by Cursor Automation: Assign PR reviewers}

[cursor]

Stale comment

Risk assessment: Very Low

Re-evaluated after the latest push (394d274). Risk is unchanged from the prior Very Low approval, so that approval stands and is not being dismissed or re-issued.

Evidence (from the diff, not the PR description)

• 24 files: 23 .mdx pages plus docs.json. No application code, CI, infrastructure, schema, or runtime logic.
• Incremental change since the last assessment (46edc53): comparison-table copy in auth/overview.mdx only (2 insertions, 3 deletions). The best for row was removed; login navigation stayed first, and example use cases was reworded.
• docs.json updates remain sidebar grouping and redirects only (/auth/agent/overview → /auth/managed-auth, plus /auth/credential-fill/existing-vault → /vaults/existing-credential-vault).
• New pages (auth/credential-fill.mdx, auth/managed-auth.mdx, vaults/existing-credential-vault.mdx) are developer documentation and SDK examples. They describe existing auth products; they do not change auth, billing, or permission implementations.
• Remaining edits are changelog, homepage copy, and cross-links.
• No CODEOWNERS file in this repository, so code-owner review is not required for this automation decision.
• No .git-blame-ignore-revs commits to exclude.

Why Very Low: documentation-only Mintlify content and navigation. No production logic, shared services, or infra blast radius.

Action: no approval change. The existing Very Low approval remains in effect.

  

_{Sent by Cursor Automation: Assign PR reviewers}

[cursor]

Stale comment

Risk assessment: Very Low

Re-evaluated after the latest push (dbbe73fd). Risk is unchanged from the prior Very Low approval, so that approval stands and is not being dismissed or re-issued.

Evidence (from the diff, not the PR description)

• 29 files: 28 .mdx pages plus docs.json. No application code, CI, infrastructure, schema, or runtime auth/permissions logic.
• New/rewritten pages (auth/overview.mdx, auth/managed-auth.mdx, auth/credential-fill.mdx, vaults/existing-credential-vault.mdx) remain Mintlify docs and SDK examples.
• docs.json only reorganizes the Auth/Vaults sidebars and updates redirects (/auth/agent/overview → /auth/managed-auth, plus /auth/credential-fill/existing-vault → /vaults/existing-credential-vault).
• The post-approval delta since the last assessment is documentation copy in 10 .mdx files: narrower wording on automatic reauthentication limits, a new FAQ on email/SMS verification, and a React reconnect section. Those pages describe existing product behavior; they do not change production logic or widen blast radius beyond the docs site.
• Remaining edits are title/link retargets after /auth/overview became a decision page.
• No CODEOWNERS file, so codeowner review is not required.

Blast radius: docs-site copy and navigation only. Incorrect guidance or a broken link would affect readers, not production systems.

Decision: Very Low. Already approved; no re-approval.

  

_{Sent by Cursor Automation: Assign PR reviewers}

[cursor]

Stale comment

Risk assessment: Very Low

Re-evaluated after the latest push (dbbe73fd). Risk is unchanged from the prior Very Low approval, so that approval stands and is not being dismissed or re-issued.

Evidence (from the diff, not the PR description)

• 29 files: 28 .mdx pages plus docs.json. No application code, CI, infrastructure, schema, or runtime auth/permissions logic.
• New/rewritten pages (auth/overview.mdx, auth/managed-auth.mdx, auth/credential-fill.mdx, vaults/existing-credential-vault.mdx) are Mintlify docs and SDK examples. auth/managed-auth.mdx is the prior overview tutorial moved to its own URL.
• Remaining edits are title/link retargets after /auth/overview became a decision page and Managed Auth moved to /auth/managed-auth.
• docs.json only reorganizes the Auth/Vaults sidebars and updates redirects (/auth/agent/overview → /auth/managed-auth, plus /auth/credential-fill/existing-vault → /vaults/existing-credential-vault).
• The post-approval delta since the last assessment (394d274) is documentation copy in 10 .mdx files (+31/−21): tighter automatic-reauthentication limits, NEEDS_AUTH recovery wording, and a React reconnect section. That does not add production logic or widen blast radius.
• No CODEOWNERS file, so codeowner review is not required.

Blast radius: docs-site copy and navigation only. Incorrect guidance or a broken link would affect readers, not production systems.

Decision: Very Low. Already approved; no re-approval.

  

_{Sent by Cursor Automation: Assign PR reviewers}

[cursor]

Stale comment

Risk assessment: Very Low

Re-evaluated after the latest push (13adebc). Risk is unchanged from the prior Very Low approval, so that approval stands and is not being dismissed or re-issued.

Evidence (from the diff, not the PR description)

• 29 files: 28 .mdx pages plus docs.json. No application code, CI, infrastructure, schema, or runtime auth/permissions logic.
• New/rewritten pages (auth/overview.mdx, auth/managed-auth.mdx, auth/credential-fill.mdx, vaults/existing-credential-vault.mdx) are Mintlify docs and SDK examples. auth/managed-auth.mdx is the prior overview tutorial moved to its own URL.
• Remaining edits are title/link retargets after /auth/overview became a decision page and Managed Auth moved to /auth/managed-auth.
• docs.json only reorganizes the Auth/Vaults sidebars and updates redirects (/auth/agent/overview → /auth/managed-auth, plus /auth/credential-fill/existing-vault → /vaults/existing-credential-vault).
• The post-approval delta since the last assessment (dbbe73fd) is one introductory sentence removed in auth/managed-auth.mdx. That is documentation wording only; it does not add production logic or widen blast radius.
• No CODEOWNERS file, so codeowner review is not required.

Blast radius: docs-site copy and navigation only. Incorrect guidance or a broken link would affect readers, not production systems.

Decision: Very Low. Already approved; no re-approval.

  

_{Sent by Cursor Automation: Assign PR reviewers}

[cursor]

Stale comment

Risk assessment: Very Low

Re-evaluated after the latest push (13adebc5). Risk is unchanged from the prior Very Low approval, so that approval stands and is not being dismissed or re-issued.

Evidence (from the diff, not the PR description)

• 29 files: 28 .mdx pages plus docs.json. No application code, CI, infrastructure, schema, or runtime auth/permissions logic.
• New/rewritten pages (auth/overview.mdx, auth/managed-auth.mdx, auth/credential-fill.mdx, vaults/existing-credential-vault.mdx) remain Mintlify docs and SDK examples.
• docs.json only reorganizes the Auth/Vaults sidebars and updates redirects (/auth/agent/overview → /auth/managed-auth, plus /auth/credential-fill/existing-vault → /vaults/existing-credential-vault).
• The post-approval delta since the last assessment is one intro sentence removed in auth/managed-auth.mdx. That is documentation wording only; it does not add production logic or widen blast radius.
• No CODEOWNERS file, so codeowner review is not required.

Blast radius: docs-site copy and navigation only. Incorrect guidance or a broken link would affect readers, not production systems.

Decision: Very Low. Already approved; no re-approval.

  

_{Sent by Cursor Automation: Assign PR reviewers}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 13adebc. Configure here.}

[cursor]

TOTP reauth gated on saved secret

Medium Severity

Several Managed Auth pages now present TOTP as something KERNEL can do when a totp_secret is available. Automatic reauthentication still attempts TOTP without a stored secret and fails with totp_required; can_reauth is not limited to credentials that already include one. The same gating appears in the configuration, credentials, and Hosted UI intros.

Additional Locations (2)

• auth/managed-auth.mdx#L203-L204
• auth/programmatic.mdx#L92-L93

 

^{Triggered by learned rule: Unattended reauth uses typed terminal error_codes}

^{Reviewed by Cursor Bugbot for commit 13adebc. Configure here.}

[cursor]

Stale comment

Risk assessment: Very Low

Re-evaluated after the latest push (a2b2fb35). Risk is unchanged from the prior Very Low approval, so that approval stands and is not being dismissed or re-issued.

Evidence (from the diff, not the PR description)

• 33 files: 32 .mdx pages plus docs.json. No application code, CI, infrastructure, schema, or runtime auth/permissions logic.
• New/rewritten pages (auth/overview.mdx, auth/managed-auth.mdx, auth/credential-fill.mdx, vaults/existing-credential-vault.mdx) remain Mintlify docs and SDK examples.
• docs.json only reorganizes the Auth/Vaults sidebars and updates redirects (/auth/agent/overview → /auth/managed-auth, plus /auth/credential-fill/existing-vault → /vaults/existing-credential-vault).
• The post-approval delta since the last assessment (13adebc5) is documentation-only: comparison-table copy, Managed Auth recovery wording, four reusable snippet files extracted from the vault cookbook, and those snippets imported into auth/credential-fill.mdx. That does not add production logic or widen blast radius.
• No CODEOWNERS file, so codeowner review is not required.

Blast radius: docs-site copy and navigation only. Incorrect guidance or a broken link would affect readers, not production systems.

Decision: Very Low. Already approved; no re-approval.

  

_{Sent by Cursor Automation: Assign PR reviewers}

[cursor]

Stale comment

Risk assessment: Very Low

Re-evaluated after the latest push (a2b2fb35). Risk is unchanged from the prior Very Low approval, so that approval stands and is not being dismissed or re-issued.

Evidence (from the diff, not the PR description)

• 33 files: 32 .mdx pages/snippets plus docs.json. No application code, CI, infrastructure, schema, or runtime auth/permissions logic.
• New/rewritten pages and four new Mintlify snippets (snippets/create-credential-vault.mdx, attach-credential-vault.mdx, collect-browser-credentials.mdx, fill-browser-credentials.mdx) are docs and SDK examples. The cookbook page shrinks by importing those snippets.
• docs.json only reorganizes the Auth/Vaults sidebars and updates redirects (/auth/agent/overview → /auth/managed-auth, plus /auth/credential-fill/existing-vault → /vaults/existing-credential-vault).
• The post-approval delta since the last assessment is documentation copy and example extraction: comparison-table/use-case wording in auth/overview.mdx, a plainer recovery note in auth/managed-auth.mdx, Credential Fill steps with shared snippets, and fill backticks in vaults/fill.mdx.
• No CODEOWNERS file, so codeowner review is not required.

Blast radius: docs-site copy, examples, and navigation only. Incorrect guidance or a broken link would affect readers, not production systems.

Decision: Very Low. Already approved; no re-approval.

  

_{Sent by Cursor Automation: Assign PR reviewers}

[cursor]

Stale comment

Risk assessment: Very Low

Re-evaluated after the latest push (261e67ee). Risk is unchanged from the prior Very Low approval, so that approval stands and is not being dismissed or re-issued.

Evidence (from the diff, not the PR description)

• 33 files: 32 .mdx pages/snippets plus docs.json. No application code, CI, infrastructure, schema, or runtime auth/permissions logic.
• New/rewritten pages (auth/overview.mdx, auth/managed-auth.mdx, auth/credential-fill.mdx, vaults/existing-credential-vault.mdx) and four Mintlify snippets are documentation and SDK examples, not executable product code.
• docs.json only reorganizes Auth/Vaults sidebar groups and updates redirects (/auth/agent/overview → /auth/managed-auth, plus /auth/credential-fill/existing-vault → /vaults/existing-credential-vault).
• The post-approval delta since the last assessment (a2b2fb35) is documentation copy in two files (auth/overview.mdx, auth/credential-fill.mdx): use-case bullets and a short assistant/QA example. That does not add production logic or widen blast radius.
• No CODEOWNERS file, so codeowner review is not required.

Blast radius: docs-site copy, examples, and navigation only. Incorrect guidance or a broken link would affect readers, not production systems.

Decision: Very Low. Already approved; no re-approval.

  

_{Sent by Cursor Automation: Assign PR reviewers}

[cursor]

Risk assessment: Very Low

Re-evaluated after the latest push (261e67ee). Risk is unchanged from the prior Very Low approval, so that approval stands and is not being dismissed or re-issued.

Evidence (from the diff, not the PR description)

• 33 files: 32 .mdx pages/snippets plus docs.json. No application code, CI, infrastructure, schema, or runtime auth/permissions logic.
• New/rewritten pages and Mintlify snippets remain docs and SDK examples.
• docs.json only reorganizes the Auth/Vaults sidebars and updates redirects (/auth/agent/overview → /auth/managed-auth, plus /auth/credential-fill/existing-vault → /vaults/existing-credential-vault).
• The post-approval delta since the last assessment is documentation copy in auth/overview.mdx and auth/credential-fill.mdx (use-case bullets and one common-example paragraph per path). That does not add production logic or widen blast radius.
• No CODEOWNERS file, so codeowner review is not required.

Blast radius: docs-site copy and navigation only. Incorrect guidance or a broken link would affect readers, not production systems.

Decision: Very Low. Already approved; no re-approval.

  

_{Sent by Cursor Automation: Assign PR reviewers}

[masnwilliams]

lgtm, thanks for working through this