Skip to main content

​
Context

Coding agents (Claude Code, OpenCode, delegate.mjs tasks) and product agents (0100) both make authenticated HTTP calls. Infisical Agent Vault is a forward HTTPS proxy (port 17323, used through HTTPS_PROXY and a CA certificate; Node needs NODE_USE_ENV_PROXY=1) that injects real credentials as HTTP headers per service in an access bundle. Agents hold only a time-bound session token, and sessions are logged. It handles HTTP header auth only (bearer, basic or pass-through), with no SigV4 and no database credentials. It is part of Infisical, so it is not a second vault under 0009.

​
Decision

  1. The rule everywhere: the model never sees a secret. AWS (Bedrock, S3 and the rest) is always reached through IAM roles, never keys.
  2. Per environment:
  3. Tenant BYO OAuth and API credentials stay in the connections store (0107), not in Agent Vault.
  4. @stackra/ai egress is a driver: direct is the default; agent-vault is opt-in per environment. Nothing in a package depends on the proxy being present.
  5. delegate.mjs creates a task-scoped session per delegated task and revokes it when the task ends.

​
Consequences

  • A leaked agent transcript holds at most a short-lived session token.
  • The proxy is one more production component on the SaaS path; on-prem never needs it.
  • Open: the Infisical plan tier that includes Agent Vault, and whether it can be self-hosted, are not yet verified.

​
Enforcement

Planned: a guard-bash rule refusing agent commands that print HTTPS_PROXY session tokens; a deploy check that production AI services have no third-party API key in their secret store. Nothing checks this today.

​
Supersedes and sources

Supersedes: none. Consistent with 0009 (Agent Vault is Infisical). Sources: owner decision in chat, 2026-10-19 (Round 11 AV).