← Back
Home › Systems › AI and agent security

agent-credentials

just-in-time credentials and secret brokering for agents

Aembit, 1Password agents

SystemTechniques · 28Primitives · 78 agent-credentials Config distributiondistributed · medium: A control plane pushes versioned resource changes over long-lived streams; each node validates, ACKs or NACKs and keeps its last good copy, so a bad change stops at a canary.›Deterministic simulation testingdistributed · medium: Run the whole system in one thread under a seeded scheduler with simulated network, disk and clock, so every failure replays from its seed.›Primary-backup replicationdistributed · medium: One node orders all writes and ships them to standbys; the acknowledgement rule (none, one, all) sets what a crash loses, and an external arbiter decides who takes over.›Reverse proxynetworking · medium: A server-side intermediary that terminates client connections and forwards each request to one of a pool of upstream servers, with routing, health checks, timeouts and safe retries.›Coverage-guided fuzzingsecurity · medium: Mutate inputs, run an instrumented target, and keep any input that reaches a new code edge; feedback turns blind guessing into incremental search.›Device posture checkssecurity · medium: Collecting and verifying device health (OS version, disk encryption, EDR running, managed cert) before granting accessEgress proxy filteringsecurity · medium: Forcing sandbox network traffic through a proxy with domain allowlists, TLS SNI checks and request loggingLeasesdistributed · low: A lock that expires on its own: bounded-time ownership that survives crashes and partitions, given bounded clock drift and fencing tokens on writes.›X509 certificatessecurity · low: Certificate chains, path validation, SANs, revocation and short-lived issuanceSecure memory zeroizationsecurity · low: Keep secrets in one locked, fixed-size, non-copyable region, erase them with writes the compiler must keep, and exclude them from dumps and swap.›Secrets managementsecurity · low: Keep keys and passwords out of code and logs, give workloads short-lived identity instead of static keys, and make rotation routine.›JSON Web Token (JWT)security · low: A signed, URL-safe token carrying claims; the verifier's job is the checklist (pinned algorithm, key by kid, exp, aud, iss), not the format.›Mutual TLSsecurity · low: TLS where the client also proves a certificate key, so every connection carries a verified, rotatable machine identity.›HKDF key derivation (extract-and-ex…security · low: HMAC-based two-step key derivation: extract a uniform pseudorandom key from any secret, then expand it into as many context-bound keys as you need.›Hdr histogramdata-structures · low: Log-linear bucketed histograms with bounded relative error for latency percentilesProcess supervisionhardware-os · low: A parent process starts services, reaps their exits and restarts them under a delay and burst-limit policy, then stops them with SIGTERM before SIGKILL.›Capability tokenssecurity · low: Unforgeable, attenuable tokens granting specific rights (macaroons, biscuits, object capabilities)Hmac request signingsecurity · low: HMAC canonical-request signatures and presigned URLs (SigV4 style) with expiryOAuth 2 and OpenID Connectsecurity · low: Delegated authorization (OAuth 2) and login on top of it (OIDC); use authorization code + PKCE for every user-facing client.›Secret scanningsecurity · low: Detect committed credentials with provider-specific patterns, entropy checks and live verification, then revokeShamir secret sharing (k-of-n)security · low: Split a secret into n shares so any k reconstruct it and any k-1 reveal nothing at all, using a random polynomial over a finite field.›Graceful drainingsystems · low: On a termination signal, stop taking new work, finish in-flight work until a deadline, tell clients to reconnect elsewhere, then exit; clients resume from a token.›Delta encodingcompression · low: Store differences between consecutive values instead of the values, turning sorted IDs, timestamps and counters into small numbers that pack into few bits.›+ 21 more techniques+ 62 more primitives

Similar systems

Share the most building blocks with this one.

agent-identity 48 %secrets-kms 45 %zero-trust 43 %drm 34 %agent-gateway 33 %