Put the subject on the start event if a later step needs an id. Leave the bearer on the HTTP request. A snapshotted event would keep a token you stored there.

## What the model can see

The model can see the subject the hook already verified, and a refusal when the hook stopped the call. It cannot see the access token or the client secret. A prompt that asks the model who the caller is ignores the hook. The hook already returned unauthorized when userinfo did not accept the bearer.

Do not copy the token into graph state, crew inputs that tasks render, callback state the model reads, or telemetry context.

## Related

| Read | To learn how to |
| --- | --- |
| [Authorizing tool calls for LlamaIndex Workflows](/docs/ai/llamaindex/authorize-tool-calls) | Refuse work after the subject is known |
| [Custom channel auth for LlamaIndex Workflows](/docs/ai/llamaindex/channel-auth) | Keep the bearer on the hook |
| [LlamaIndex Workflows](/docs/agent-frameworks/llamaindex) | See the planned sample |
| [API keys and M2M for LlamaIndex Workflows](/docs/ai/llamaindex/api-keys-and-m2m) | Keep the secret on the caller |