Give agents enough access to finish the work. Nothing more.
Veridian Secrets Manager gives people, applications, CI, and agents one organization-scoped source of truth. Every agent grant names the vaults, operations, and duration before access begins.
Trace an authorization- Organization
- Veridian Code
- Existing vault
- Production deploy
- Allowed operations
- read · inject
- Duration
- 02:00:00
Scoped access active
One decision. One bounded machine session.
Authorization is explicit, short-lived, and tied to the client proof key. It is not a reusable password copied to an agent’s disk.
- 01
Ask
The agent requests exact vaults, operations, and duration.
- 02
Review
A person checks the scope and approves with the installed Mac client.
- 03
Work
The session operates without repeated prompts inside that approved boundary.
- 04
End
Expiry or revocation terminates access immediately.
Security is the operating model.
The first release is intentionally narrow: organization tenancy, proof-of-possession sessions, explicit vault and operation scopes, and an auditable path through HTTP MCP and native clients.
- 1Exact existing vault IDs—no wildcard grants
- 2Separate read, create, update, delete, export, and injection operations
- 3DPoP-bound OAuth tokens and immediate session revocation
- 4HTTP MCP, API, CLI, web portal, and native macOS client
- 5Invite-only tenant access while the product is refined
Request a Secrets Manager invite.
Tell us what will use the vaults and which authorization path you need first.