Runway Credential, Media, and Moderation Controls

Overview

Runway integrations handle organization-scoped credentials and potentially sensitive media. Security must cover key lifecycle, server-only egress, input rights, temporary URL capabilities, moderation outcomes, output access, evidence minimization, and incident response.

Prerequisites

• Data classification and media-rights policy
• Runway organization role and key inventory
• Secret manager, private object storage, audit logging, and incident owners

Instructions

Step 1: Inventory identities and keys

List organization members, roles, keys, consumers, environments, creation dates, and rotation owners. Removing a member does not disable their organization-scoped keys, so revocation is a separate control.

Step 2: Enforce server-only access