Secret handles
Agents never receive secret material. They receive an opaque handle, and Cirvix substitutes the real value into the outbound request at the moment of use.
A secret placed in an agent's context is in the model's context window, in the prompt log, in the trace, and in whatever the agent decides to write next. It cannot be recalled. The fix is to never put it there.
How a handle resolves
agent → POST https://api.stripe.com/v1/charges Authorization: Bearer sec_handle_a89f ^^^^^^^^^^^^^^^^ opaque; useless off-path cirvix → resolve sec_handle_a89f ├─ policy permit (destination allowlisted: api.stripe.com) ├─ identity agt_7Q2X9F, owner priya@example.com ├─ vault aws-sm://prod/stripe/restricted_key └─ substitute Authorization: Bearer rk_live_•••••••••••• stripe ← request carries the real credentialtrace ← records the handle, never the valueRequesting a handle
import { secrets } from "@cirvix/agent-control"; // Returns an opaque handle: "sec_handle_a89f".// The model sees this string and nothing else.const key = await secrets.get("STRIPE_RESTRICTED_KEY"); await fetch("https://api.stripe.com/v1/charges", { headers: { Authorization: "Bearer " + key },}); // The same handle sent to evil.example resolves to nothing and the// call is denied by the egress policy before it reaches a socket.Bring your own vault
Values stay in the vault you already run. Cirvix brokers access; it is not another place your secrets live.
- HashiCorp Vault
- AWS Secrets Manager
- Azure Key Vault
- GCP Secret Manager
Leak detection on the return path
Tool results are scanned for material matching a known secret before reaching the model, so a misbehaving endpoint that echoes a credential is caught on the way back.
Warning
Leak detection matches known secret material. A credential Cirvix was never told about cannot be recognised on the return path — this is a backstop, not a substitute for scoping what an agent's handles can reach.
Limits
- Substitution protects the credential from the model. It does not stop an authorized call from doing something expensive — that is what policy and approvals are for.
- On a developer machine the broker holds resolved material in process memory for the life of a request. A laptop with a root-level compromise is outside any userspace product's threat model.
Edit this page on GitHub
Was this page helpful?