Agent signing keypair
Proves which agent is calling. RS256 keypair, generated on the customer device. We never see the private half.
Three trust zones, three keys, one decryption moment. Below is the high-level shape: what is held where, what is encrypted with what, and which boundary an attacker would have to cross to do real harm. Each audit row records which credential and which account connection were used. Agent identity uses CIMD identity documents with JWKS. Policy evaluation follows the AuthZEN standard. Delegation chains follow RFC-8693 with mandatory scope attenuation. Revocation cascades at the proxy: suspend an agent and its signed JWTs stop validating on the next call, no token outlives the change.
A credential never sits in plaintext on two sides of any boundary at once. Each zone has a different operator, a different blast radius, and a different recovery story if it falls.
Each key has exactly one purpose and lives with exactly one party. No key can do another key's job on its own. Compromise one and you lose one layer.
Proves which agent is calling. RS256 keypair, generated on the customer device. We never see the private half.
Wraps every per-credential DEK belonging to one customer. On paid plans it is stored exclusively in a hardware security module and the key material never leaves it. On the Free plan it is derived per tenant from a master secret held outside the database, rather than stored in hardware.
Encrypts one credential. Born fresh per credential, wrapped immediately by the tenant KEK, then stored as ciphertext alongside the wrapped credential.
Plaintext exists for the seconds it takes to encrypt or use. Outside those moments, the credential is ciphertext. The proxy is stateless across calls.
The OAuth callback returns a token to AgentValet's edge over TLS. The token exists in memory only. We immediately generate a fresh per-credential DEK, encrypt the token, wrap the DEK using the tenant's KEK, then forget both plaintexts.
Only the encrypted credential, the wrapped DEK, the IVs and tags, and a reference to the KEK version are stored. Postgres Row Level Security enforces that one tenant cannot see another's rows even with a stolen connection string.
The agent signs a 60-second JWT with its private key, sends it with the call. The proxy verifies the signature against the public key on file, evaluates policy (scope, approval gate, rate limit) before touching any credential.
The tenant's KEK unwraps the DEK. The DEK decrypts the credential. The credential is attached to the outbound upstream call, the call fires, the response returns. The plaintext is dropped before the function returns. Nothing is logged that would let an operator reconstruct the token.
An append-only audit row captures who, what, when, scope, result, and the size of the call. It does not capture the credential or the response body. The log is enforced append-only by row-level security (INSERT only, no UPDATE or DELETE). Each row records which credential and which account connection were used.
Every credential is still encrypted with its own AES-256-GCM data key bound to your organisation, and the key that wraps it is derived per organisation from a master secret held outside the database. Stealing the database alone decrypts nothing.
What Free does not include is a key held in dedicated hardware. That is what makes a key impossible to copy out of the system, and what produces per-key access logs. Paid plans move your organisation onto a hardware-backed key automatically, with no re-encryption and no downtime.
Across five common actors, here is exactly what each can read about a credential. Cells are intentional. On the hosted plan, AgentValet engineers hold Key Vault access to operate the service. Every key-vault operation is logged. The "operator" row reflects what is accessible day-to-day via app credentials.
Each layer can revoke independently. From the smallest scalpel to the global cut, here is what each pull actually shuts down. None of them require AgentValet to ship code.
Untick a scope on one agent's permission row. Next call returns scope_not_granted. Upstream untouched.
Suspend or revoke the agent. Its JWTs stop validating. Any other agents owned by the same human keep working.
one agent · all scopesDisconnect a platform at the owner level. All agents lose access to that SaaS instantly. Deactivate the agent and AgentValet revokes the stored OAuth refresh-token chain so the upstream grant cannot be reused.
one platform · all agentsRotate or delete the tenant KEK. Every wrapped credential for that tenant becomes unrecoverable. Tenant-wide kill switch.
one tenant · everythingThe boundaries we hold even when it would be convenient not to.
We send a detailed architecture document, our DPIA template, and a written breach-analysis Q&A to security reviewers under NDA. If your compliance team needs to dig into any layer above before you can buy, this is the next conversation.