Choose the boundary
s-gw and 1Password CLI solve different parts of credential use
1Password is a mature secret manager with a broad CLI. s-gw is an agent-facing control layer for turning a typed-handle request into a locally approved action. They can be used together.
Side by side
Storage and action approval are separate jobs
This comparison describes workflow boundaries, not a claim that one product replaces the other.
| Question | 1Password CLI | s-gw |
|---|---|---|
| Main job | Store, retrieve, inject, and manage secrets from a 1Password account. | Broker agent requests into bounded, locally approved executions. |
| Reference seen by automation | op:// secret references and environment/config integrations. | Typed s-gw:… handles with non-secret metadata. |
| Execution path | op run provisions resolved values to an application or script subprocess. | A request records the agent and action scope before the local runner resolves and injects a value. |
| Approval scope | Authentication and access are governed by the 1Password account, vault, item, service account, and local app or CLI session. | Approval can bind agent, handle, executable, arguments, environment name, working directory, target, and duration. |
| Returned command output | Use the controls documented for the selected 1Password workflow. | Known raw credential values are replaced before captured output returns to the agent. |
| Best fit | Central secret management and general developer or workload access. | Explicit control and audit of credential-backed actions proposed by coding agents. |
Use both
Keep 1Password as the source and put s-gw at the agent boundary
s-gw can store an encrypted op:// reference instead of the raw secret. When an approved action runs, the local integration resolves the value and injects it into that local child process.
Division of responsibility
1Password: account, vault, item, and secret lifecycle.
s-gw: agent identity, requested action, local approval, execution, sanitization, and local audit.
Decision guide
Use the narrowest workflow that solves the problem
- Use 1Password CLI directly when trusted scripts need standard secret retrieval or injection and its access model fits.
- Add s-gw when an AI coding agent should propose a use but should not receive the raw value or broad store access.
- Keep provider-side least privilege, rotation, and audit controls either way.
Primary references