AgentVault Technology
Runtime security layer. Storage, permission, and execution layers.
Overview
AgentVault is built as a runtime security layer. It does not just store secrets, it controls how those secrets are used.
Traditional systems protect data at rest. AgentVault protects data during execution.
Core Design Layers
AgentVault is structured into three main layers: storage, permission, and execution.
1. Storage Layer
Encrypted Vault
- Uses strong encryption (AES-256-GCM with scrypt key derivation, random salt per file)
- Protects API keys and secrets
- Ensures data cannot be accessed directly
- Secrets are never exposed in raw form
- Storage is isolated from agent logic
Local-First Security
AgentVault follows a local-first approach:
- Credentials remain in user-controlled environments
- Reduces dependency on centralized systems
- Minimizes risk of large-scale breaches
2. Permission Layer
Profiles
Each profile contains rules: which APIs can be accessed, which actions are allowed, which data is restricted.
Rule Types
- Allow → grant access
- Deny → block access
- Filter → modify or redact output
Granular Control
Permissions can be applied at: service level, endpoint level, action level, and data field level.
3. Execution Layer
Controlled Execution Model
Agents never interact with systems directly. All requests go through AgentVault, which performs validation and executes actions on behalf of the agent.
Request Lifecycle
Session Management
Each agent operates within a session that defines duration, scope of permissions, and active context.
Sessions support: starting new sessions, pausing execution, terminating sessions, and revoking permissions.