Vault

The vault holds credentials. An agent uses one to do the thing that needs it, and does not quote it back, summarise it, or write it anywhere.

One capability per item

There is no vault.get that takes an item name. There is vault.get.github_token, and vault.get.stripe_key, and one capability for every other item you have stored.

That is what makes the policy-filtered tool list the listing, and the only listing that cannot over-report. An agent granted vault.get.github_token cannot discover that vault.get.bank_password exists, because a capability it has no grant for is never advertised to it.

There is no vault.list. Adding one would hand back exactly the thing the design just removed.

Tools only, never resources

Resources are listable and cacheable. Both are wrong for a secret, so the vault publishes no resources at all.

A write cannot hand itself a read

Capabilities are fixed for the life of a process. An item written by vault.put is therefore not readable until the endpoint restarts, because the vault.get.<item> capability for it did not exist when the tool list was built.

This surprises people once. It is the same property that makes the tool list trustworthy.

What your agent can do

From the CLI

$ lanes link vault list --profile personal --workspace local
$ lanes link vault set stripe-key --profile personal --workspace local
$ lanes link vault get stripe-key --profile personal --workspace local
$ lanes link vault remove stripe-key --profile personal --workspace local
$ lanes link vault key generate --profile personal

Values go in on stdin, never as a flag. An argument lands in your shell history, in ps output, and in any transcript.

Where it lives

One AES-256-GCM encrypted document under its own key, and it never uses the system credential store. It is never kept in a repository, and lanes link knowledge use github will not move it.

That separation is deliberate: the vault holds secrets you want an agent to spend, and the credential store holds secrets that authenticate connections. The security model has the two kinds and why they stay apart.

What is recorded

The item id is kept verbatim. The value is withheld entirely, recorded as <withheld> rather than <string:40>, because a secret's length is a real disclosure. See the audit log.

Next: the audit log, or the security model for the guarantee table.