Security boundary
Keep credential redemption outside model context
s-gw reduces accidental credential exposure by separating an agent request from local credential redemption. It is a preview control layer, not a replacement for endpoint or provider security.
Protected path
A request crosses the boundary. The raw value does not.
- 01Agent request
The coding agent supplies a typed handle, command, environment binding, working directory, destination, and reason.
- 02Local decision
A policy or user approval decides whether that bounded request may execute.
- 03Local execution
The credential is resolved inside the local boundary and injected only into the approved child process.
- 04Sanitized return
Known raw values are replaced before output returns to the caller, and the event is recorded locally.
Intended guarantees
What the current boundary is designed to enforce
- Agent-facing interfaces use handles and metadata instead of raw values.
- Execution must match the credential's allowed command or SSH policy.
- Reusable approval is bounded by stored request attributes and expiry or login session.
- Approved environment commands start with a cleared child environment plus allowlisted values.
- Approval, execution, denial, failure, and policy activity are recorded locally.
Residual risk
Approval is not containment
A malicious approved executable can still misuse a credential. s-gw cannot defend a compromised operating-system account, kernel, credential store, or process, and output scanning cannot detect every transformed derivative of a secret.
Keep allowed commands narrow, review destinations and arguments, prefer low-privilege credentials, and keep independent provider-side controls enabled.