Separate metadata from values
The service exposes secret metadata, scope, grants, recipients, replacement and retirement through distinct operations. A client should request only the operation its task requires. A listing is not evidence that the client may reveal the stored value.
Agent execution
A reviewed launch can refer to the credentials and accounts its harness requires. The credential must remain at its intended boundary: selecting an account is not permission to forward its private value into an unrelated broker or tool.
Sealed hand-off
The standalone cryptographic CLI can seal bytes to a recipient’s key and attest to the envelope. Opening verifies the expected sender before decrypting and writes plaintext to a private output file. The syntax is in Command line.
Replacement and retirement
Replacing a value, changing scope and retiring a secret are distinct changes with separate admission. Retain their receipts and investigate a refused operation before repeating it.