Credential vault (secret isolation for AI agents)

What it is

Secret isolation for agents. Instead of giving an agent a vendor's API key, you give it a credential for the vault side, which holds the vendor key and attaches it to each permitted request. The agent can use the vendor; it can never read, leak or reuse the vendor secret.

Why it matters

Anything in a model's context can end up in its output. A prompt-injected agent can be talked into printing or sending whatever secrets it can see. Secrets in a local MCP server's environment or config file are exposed to every process on that machine. The OWASP MCP cheat sheet says never to store OAuth tokens in plaintext in MCP config files and to use scoped, per-server credentials.

How it works

OWASP's secrets-management cheat sheet sets out the practice:

• Centralise secrets in one managed store.
• Least privilege: nobody, human or agent, reads all secrets.
• Encrypt with envelope encryption: a data key encrypts the secret, a master key encrypts the data key; use authenticated encryption such as AES-256 in GCM mode (NIST SP 800-38D).
• Rotate where possible, and audit every use.
• Avoid environment variables, which can leak into logs and dumps.

For agents, add one more rule: decrypt only for the duration of one outbound request, and never return the secret through any API.

Example

An agent needs to read invoices. It holds key al_... with read:* on the accounting connection. When it calls do, the platform decrypts the stored OAuth token in memory, attaches it to the vendor request, and discards it. The agent's transcript contains the invoices and nothing else.

Common pitfalls

• Pasting an API key into a prompt "just this once".
• One admin token shared by every agent and every person.
• Logging request headers, which carry the token.
• Long-lived personal access tokens where short-lived OAuth tokens are available.

How actionlake handles it

The actionlake vault seals each credential with AES-256-GCM under a per-tenant data key, wrapped by a master key. The credential is unwrapped in memory for one upstream call. It is never logged, never returned by any endpoint and never placed in a prompt. The agent holds an actionlake key, never a vendor token, and revoking that key cuts its access without touching the vendor credential. OAuth refresh happens on our side. Honest limits: the master key is an environment key, not a hardware security module; customer-managed keys are not offered today; and a deleted connection's encrypted row remains in backups for up to seven days. Who can reach production is stated on the trust page.