An agent that only reads can embarrass you. An agent that writes can cost you.

That single line is the whole reason Agent Vault exists.

For most of the last two years, agents were readers. They pulled context, answered a question, and forgot everything by the next run. A bad answer was a bad answer. You corrected it and moved on. The blast radius ended at the screen.

Then agents started acting. Sending the email. Moving the funds. Updating the record. Writing back to the system other people depend on.

The moment an agent can write, the question changes. It stops being "is the answer good" and becomes "what is this thing allowed to touch."

Most agents today cannot answer that question at all.

How agents actually hold your secrets

Open a typical agent project and look at how it stores credentials. API keys sit in plain text in an environment variable. The agent gets handed all of them at once. Nothing checks what it does with them. Nothing writes down what happened.

This works right up until it doesn't.

A prompt injection talks the agent into printing its own environment. A single over-broad key turns a small mistake into a large one. Something goes wrong at 2 am and there is no log to tell you which action caused it, because no action was ever recorded.

None of that is a model failure. The model did what it was told. The failure is that the agent was trusted by default, and trust by default is not a security model. It is the absence of one.

Put a doorman in front of the door

Agent Vault sits between the agent and everything it reaches. The agent no longer holds the keys. It makes a request, and the request goes through a check first.

The rule underneath it is simple: start with no access. An agent begins with nothing. It receives exactly what a written profile grants it, nothing more. Every request is evaluated against that profile. Every decision is logged. Access can be pulled back the instant something looks wrong.

The agent never sees the raw credential. It sees the result of an action it was permitted to take. The difference sounds small and is not. A key the agent cannot read is a key a prompt injection cannot leak.

The parts that make it real

Credentials are encrypted at rest with AES-256-GCM, each with its own salt. The agent never touches the plaintext.

Permissions live in a profile written in plain YAML. Allow this. Deny that. Redact the sensitive field but keep the variable name so the agent still works. A person can read the whole permission set in one sitting and know precisely what the agent can do.

Every decision the vault makes lands in an audit trail that cannot be quietly edited later. When you need to know what happened, the answer is already written down.

And the standard underneath all of it, the Agent Vault Protocol, is open and MIT licensed. Not a black box you have to trust. A specification you can read, run, and carry between tools.

Why this had to come now

Inflectiv is built so agents write intelligence back to the network, not just read from it. That is the entire point of a supply side that compounds. But the instant an agent can write to something other people rely on, a permission model stops being a nice-to-have and becomes the load-bearing wall.

You cannot invite agents to produce and leave them holding every key in the building.

A reading agent is safe. A writing agent needs a lock.

Agent Vault is the lock.

Live at agentvault.inflectiv.ai.