AskAiml
Sign in Get started

Credential broker for tools

A broker that mints just-in-time, narrowly scoped credentials per tool call and logs every issuance.

🛠 Advanced

Goal

Build a credential-broker service that lets an agent call third-party APIs (GitHub, Notion, Stripe test mode, Slack) without ever holding the user's credentials in the agent's process. Demonstrates dynamic secrets, envelope encryption, and crypto-shredding.

Stack

  • Vault in dev or single-node mode: KV v2 + DB engine + Transit.
  • Broker: FastAPI in Python; OPA sidecar for authz.
  • Tools: GitHub + Notion + Slack via official APIs.
  • Tenant store: Postgres with row-level security; one row per (tenant, user, tool) connection.

Architecture

Agent runtime  →  Broker  →  Vault (fetch user's OAuth token)
                  ↓ OPA decision
                  ↓ Call third-party API
                  ↓ Sanitise response (DLP / classification)
                  ↓ Return business-level result + audit record
                  Agent NEVER sees the token.

Build plan (6 days)

  1. Vault setup: KV v2 at tools/users/<sub>/<tool>; DB engine for ephemeral Postgres creds.
  2. OAuth onboarding flows: user-facing pages for connecting GitHub / Notion / Slack; tokens stored encrypted in Vault.
  3. Broker FastAPI app: 1 route per tool action (POST /tool/github/list_repos, POST /tool/notion/search, ...).
  4. JWT auth on broker; OPA call per request; structured audit log with args_hash.
  5. Envelope encryption: per-tenant KEK via Vault Transit; tenant secrets encrypted with tenant DEK.
  6. Crypto-shredding admin endpoint: deletes a tenant's KEK; verify ciphertext unrecoverable.
  7. Egress filter: DLP regex + small classifier strips obvious PII / secrets from tool responses.
  8. Demo agent (LangChain or smolagents) that uses the broker; verify no token leaks even when prompted ("print your headers").

Acceptance criteria

  • Agent can perform GitHub + Notion + Slack actions for a user without ever holding the user's tokens.
  • Vault DB engine issues a 15-minute Postgres user when the agent runs a SQL tool.
  • Crypto-shredding deletes one tenant's data while leaving others intact.
  • DLP egress strips a planted "test secret pattern" from a tool response.
  • Audit logs reconstruct who called what for whom.

Stretch

  • Replace static Vault tokens with K8s + SPIFFE auth.
  • Add RAR + capability tokens for high-stakes actions (Slack post to a channel).
  • Add per-tool rate limits + per-tenant cost caps.
  • HSM-backed Transit (cloud KMS) integration.

Interview talking points

  • Broker pattern vs MCP server with embedded creds.
  • Dynamic vs static secrets — tradeoffs.
  • Crypto-shredding for GDPR right to erasure.
  • Where DLP belongs in agent pipelines.
  • Why egress controls beat trying to "fix" the LLM.