The agent requests an authorized operation — not a secret.
A zero-access credential broker for AI agents. Long-lived provider keys stay sealed inside the broker; the agent submits an intent and receives only the result of the operation. Below: the general arrangement drawing.
DRG No. PK-001 · X:0000 Y:0000 Z:0000 · UNITS: operations
The broker authenticates the workload, evaluates a default-deny policy, uses a credential that never leaves the enclosure, and logs the result.
┌─────────┐
│ AGENT │ intent: "create A record api.example.com"
└────┬────┘
│ request (operation, never a secret)
▼
╔═════════════════════════════════════════════╗ ◄── trust boundary
║ CREDENTIAL BROKER ║
║ ┌──────┐ ┌────────┐ ┌────────────┐ ║
║ │ AUTH │──►│ POLICY │──►│ CREDENTIAL │ ║
║ └──────┘ └────────┘ └─────┬──────┘ ║
║ who? may it? sealed │ scoped ║
║ ┌────────┐ ▼ ║
║ │ AUDIT │◄────────────── executes ║
║ └────────┘ one event / request ║
╚════════════════════┬════════════════════════╝
│ short-lived · least-privilege
▼
┌───────────┐
│ PROVIDER │ cloudflare · github · aws · db · ssh
└───────────┘
agent ◄── RESULT only, never the key
Privilege reachable by a compromised agent, measured as a share of the underlying credential's power. To scale, 0–100%.
CREDENTIAL LIFETIME — dimensioned, provider permitting:
├──────── 60 s TTL ────────┤ scoped to: 1 zone · 1 action · 1 request-id
Assume the agent's runtime, context, or logs are fully exposed. What can the attacker actually reach?
CASE: agent runtime / context leaked TRADITIONAL PASTKEYS ─────────── ──────── attacker ─▶ CLOUDFLARE_API_TOKEN attacker ─▶ short-lived session │ │ ┌───────────┼───────────┐already spent · bound to ▼ ▼ ▼ 1 request-id all zones all records acct policy re-denies everything else audit already recorded the attempt reachable: EVERYTHING reachable: ~NOTHING
Pick a request. The bench evaluates it exactly like pastkeys policy test: allow only on an explicit rule match, everything else denied, errors fail closed.
Adapters implement a common contract; the roadmap below reflects pilot build status, not a completed system.
| Item | Adapter | Operations | Status |
|---|---|---|---|
| 01 | cloudflare | DNS read / create / update / delete | in progress |
| 02 | github | repo read · pull-request create | planned |
| 03 | aws (sts) | scoped session · s3 · secrets | planned |
| 04 | postgres | dynamic short-lived credentials | planned |
| 05 | ssh (ca) | certificate issuance | research |
Verify the agent's workload identity.
Default-deny policy over agent, provider, resource, action.
Fetch a sealed credential; scope + time-limit where the provider allows.
Perform the operation; return only the result.
Write one secret-free event. Any error resolves to DENY.
Free and open source, self-hosted. Managed control plane, SSO, approvals, SIEM export and customer-managed keys (BYOK) come with the team tier.