server: in project config.yaml; compiled launchers read their generated server.yaml.
Server properties
All property paths below are relative toserver in config.yaml.
Unknown fields, invalid types, and out-of-range values fail during compilation. Omit a field to inherit its default;
null does not mean “use the default.”
When you set agentPrincipal: required, custom HTTP routes must pass agent_principal= to AgentInvoker. To keep using /responses, live, AG-UI, or A2A, define @lifecycle.http.agent_principal before enabling the setting. Without that hook these routes refuse new invocations.
In advanced ADK mode, native clients can still invoke the agent through /run, /run_sse, and (when live is enabled) /run_live. These endpoints bypass Harnest’s grant hook even with agentPrincipal: required. Enforce any permission policy for native clients separately.