A credential vault stores secrets behind access controls, encryption, audit logging, and controlled retrieval or signing operations. Applications can request an authorized use of a credential without placing its raw value in prompts, ordinary files, or model-visible state.
For AI agents, a vault reduces exposure if the model, prompt, or tool output is compromised. The surrounding system must still verify the agent identity, requested target, permitted action, credential scope, and current policy before allowing use.
ELI5
A credential vault is a protected place for secrets that software needs, such as payment tokens or signing keys. It lets an approved operation use a secret without handing the secret itself to the AI model.
For example, an agent can request payment to a verified seller, and the vault can allow the trusted wallet service to sign it. The model receives the payment result but never sees the private signing key.
