The trust loop
An agent can use a credential without receiving it
The useful unit is an approved action, not a plaintext secret. s-gw gives the model enough information to request work while keeping redemption on the user's machine.
Four stages
From handle to useful output
- 01Reference
The agent sees a stable typed handle such as
s-gw:api-token:release-bot, plus non-secret metadata describing its intended use. - 02Request
The agent proposes a concrete command or SSH action. s-gw records the agent, handle, executable, arguments, environment binding, working directory, and target.
- 03Approve and execute
A local policy or user decision authorizes one use, a timed window, the login session, or a deliberately reusable grant. A local runner resolves the credential for that approved process.
- 04Return evidence
Known secret values are replaced in output before it returns to the agent. The local audit trail retains the request, decision, execution result, and policy evidence.
Trust boundary
Only the local runner crosses into credential storage
handle + requestpolicy + executionresult + evidenceLocal custody
Credential backends stay operator-controlled
s-gw supports macOS Keychain, Windows Credential Manager, an encrypted local ledger, and optional 1Password-backed references. Backend and platform behavior differs, so review the platform status and threat model.
The model never needs
- The raw credential
- The local unlock material
- General access to the credential store