Credential Vault
An encrypted container in which a password manager stores sensitive information, typically built on a zero-knowledge architecture so that the service provider itself cannot decrypt its contents.
Timeline (last 90 days)
In 1Password's controlled interface, when an AI agent initiates a login request, credential injection or the authentication handshake is completed inside the vault, and the agent can only obtain a login-success token or session and cannot read raw data such as usernames, passwords or TOTP seeds.
The similarity between the credential vault approach and the OAuth authorization code model is that a third party receives a token rather than a password; the difference is that OAuth requires support from the target service, whereas the credential vault approach is transparent to the target service and thus broader in applicability.
In multi-tenant agent systems, credential isolation is typically implemented through three approaches: delegated authorization, service accounts with scope mapping, and credential vaults.
The architecture of resident agents typically requires a separate daemon, a credential vault, and an event bus, and these components themselves also constitute a new attack surface.
All Facts (4)
In 1Password's controlled interface, when an AI agent initiates a login request, credential injection or the authentication handshake is completed inside the vault, and the agent can only obtain a login-success token or session and cannot read raw data such as usernames, passwords or TOTP seeds.
50%UnverifiedThe similarity between the credential vault approach and the OAuth authorization code model is that a third party receives a token rather than a password; the difference is that OAuth requires support from the target service, whereas the credential vault approach is transparent to the target service and thus broader in applicability.
50%UnverifiedIn multi-tenant agent systems, credential isolation is typically implemented through three approaches: delegated authorization, service accounts with scope mapping, and credential vaults.
50%UnverifiedThe architecture of resident agents typically requires a separate daemon, a credential vault, and an event bus, and these components themselves also constitute a new attack surface.
50%