starred/nix-config-ryan4yin
1
0
Fork 0
mirror of https://github.com/ryan4yin/nix-config.git synced 2026-08-07 12:18:39 +02:00
Code Issues Packages Projects Releases 10 Wiki Activity

docs(agents): allow scoped secret authentication

Browse Source
This commit is contained in:
Ryan Yin
2026-08-05 10:13:16 +08:00
parent 6f837b8718
commit 58e056486d
1 changed files with 7 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
agents/AGENTS.md
+7 -4
View File
@@ -37,10 +37,13 @@ If rules conflict, follow the higher-priority source and state the conflict brie
### Secret Access
- Commands or API calls that retrieve secret values or payloads are forbidden, even with explicit
user authorization and regardless of how their output is processed.
- Metadata and key names are allowed only through commands verified not to return values, such as
`kubectl describe secret`.
- When explicitly requested, an authentication client or command MAY consume a user-designated
secret source solely to authenticate to the specified service (e.g. an API, `redis-cli`, `psql`,
or `pgcli`).
- Secrets MUST remain opaque to the agent and must not be exposed in arguments, output, or logs;
copied, cached, or persisted; or sent anywhere except the intended authentication target.
- All other secret-value access is forbidden. Metadata and identifiers MAY be queried only with
operations verified not to reveal secret values, such as `kubectl describe secret`.
## 4) Scope Discipline