Agents
An agent is a registered identity in your org — a bot, service, or runtime that needs scoped, audited access to secrets and optional on-chain signing or LLM proxying.
Agents do not get blanket vault access. Humans attach policies that grant specific path patterns; JWT scopes are derived from those policies when agents.scopes is empty.
Lifecycle
- Register — Human creates agent via dashboard, API, or self-enrollment
- Policy — Human grants read/write on secret paths (golden path)
- Authenticate — Agent exchanges
ocv_API key for short-lived JWT - Operate — Fetch secrets, sign transactions, route LLM traffic, run automations
- Offboard — Revoke policies, deactivate agent, rotate keys (revoking access)
Capabilities (per-agent toggles)
| Feature | Description | Docs |
|---|---|---|
| Secret access | JIT fetch via Agent API or MCP | Agent API |
| Shroud | LLM proxy with redaction and threat detection | Shroud |
| Intents | Sign transactions without raw private keys | Intents |
| Execution Intents | HTTP/GraphQL/DB via credential bindings | Guardrails & Execution |
| Memory | Scratch, durable, and semantic agent memory | Memory |
| Channels | Telegram, WhatsApp, Discord messaging | Communication |
| Delegation | Inter-agent task delegation (human-approved) | Delegation |
| OIDC federation | Exchange agent JWT for RS256 tokens (WIF) | OIDC federation |
Signing keys
Humans provision per-chain signing keys (Ethereum, Bitcoin, Solana, XRP, Cardano, Tron). Private keys live in __agent-keys; agents sign via Intents API only.
See Multi-chain signing.