The vault holds credentials. An agent uses one to do the thing that needs it, and does not quote it back, summarise it, or write it anywhere.
Why each secret is its own capability
There is no lanes_vault.get that takes an item name. There is lanes_vault.get.github_token, and
lanes_vault.get.stripe_key, and one capability for every other item you have stored.
That is what makes the policy-filtered tool list the listing, and the only listing that cannot
over-report. An agent granted lanes_vault.get.github_token cannot discover that lanes_vault.get.bank_password
exists, because a capability it has no grant for is never advertised to it.
There is no lanes_vault.list. Adding one would hand back exactly the thing the design just removed.
Why the vault publishes no resources
Resources are listable and cacheable. Both are wrong for a secret, so the vault publishes no resources at all.
A write cannot hand itself a read
Capabilities are fixed for the life of a process. An item written by lanes_vault.put is therefore not
readable until the endpoint restarts, because the lanes_vault.get.<item> capability for it did not
exist when the tool list was built.
This surprises people once. It is the same property that makes the tool list trustworthy.
What your agent can do
| Read | Write |
|---|---|
lanes_vault.get.<item>, one per stored item | lanes_vault.put, lanes_vault.remove |
Manage secrets from your terminal
$ lanes link vault list --profile personal
$ lanes link vault set stripe-key --profile personal
$ lanes link vault get stripe-key --profile personal
$ lanes link vault remove stripe-key --profile personal
$ lanes link vault key generate --profile personalValues go in on stdin, never as a flag. An argument lands in your shell history, in ps output, and
in any transcript.
Where it lives
One AES-256-GCM encrypted document under its own key, and it never uses the system credential store.
It is never kept in a repository, and lanes link knowledge use github will not move it.
That separation is deliberate: the vault holds secrets you want an agent to spend, and the credential store holds secrets that authenticate connections. The security model has the two kinds and why they stay apart.
What is recorded
The item id is kept verbatim. The value is withheld entirely, recorded as <withheld> rather than
<string:40>, because a secret's length is a real disclosure. See
the audit log.
Next: the audit log, or the security model for the guarantee table.