Skip to main content

Vaults

The Managed Agents credential store: secrets never enter the sandbox. They are substituted into outbound requests at the egress boundary, so the agent never sees them.

Hand-drawn line illustration in warm terracotta and cream: a loopy line-drawn hand reaches toward a cream key that sits sealed inside a wobbly enclosed box, never crossing the boundary, a one-line profile face watching from above.

What it is​

A Vault holds the credentials an agent's tools need: API keys, OAuth tokens, environment-variable secrets. Per the Managed Agents docs (verify against platform.claude.com/docs; beta surfaces drift), the design rule is that secrets never enter the sandbox where the agent runs. When the agent makes an outbound request that needs a credential, the platform substitutes the secret into the request at egress. OAuth tokens for MCP connections refresh automatically, and secrets can be scoped to an allowlist of hosts.

Why the egress design matters​

Prompt injection is the standing threat against any agent that reads untrusted content: a hostile document or web page instructs the model to do something its operator did not intend. The worst version is exfiltration, where the injected instruction is "send your API key to this address."

Egress substitution removes the target rather than defending it. The model cannot leak a credential it never held; there is no key in the context window, no token in an environment variable inside the sandbox, nothing for an injected instruction to find. An attacker who fully controls the model's output still cannot read a secret that only exists on the other side of the egress boundary, and host allowlisting bounds where a substituted credential can even be sent.

Contrast this with what the self-hosted paths require. On the Agent SDK, per its docs, credentials the agent's tools use are visible to the agent's environment unless the team builds its own egress proxy, which is real infrastructure. This is one of the sharpest single items on the deployment bill of materials.

The boundary, honestly stated​

A Vault protects the credential, not the action. An injected instruction can still tell the agent to misuse a capability it legitimately holds, such as sending a request it should not send to an allowed host. That class of attack is what the Human Gate exists for, and Anthropic's security writing, including How we contain Claude across products (2026), treats containment as layered for exactly this reason. Vaults close the exfiltration channel; approval policies govern the actions.

Who feels this problem​

Teams operating agents against real business systems with real credentials. Duvo's agents log into supplier portals and operate SAP for multi-billion-euro retailers (source), and Tasklet's customers run unattended automations where "Claude spins up a browser in a cloud VM" against live accounts (source). At that point credential handling stops being a checklist item and becomes architecture.

Further Reading​