Skip to content
Security

Govern AI agents on HashiCorp Vault

Manage how AI agents access secrets and credentials through HashiCorp Vault. The Vault pack enforces least-privilege access, rotates credentials, and logs every secret request in the governance audit trail.

What this pack does

  • Least-privilege secret access for agents
  • Dynamic credential generation per agent session
  • Policy enforcement on secret paths
  • Audit trail of all credential access

Use cases

Issue short-lived database credentials to agents

Block agents from accessing production secrets without approval

Audit all agent secret access patterns

Quick setup

  1. 1Install the Vault pack: cordumctl pack install vault
  2. 2Configure Vault address and authentication method
  3. 3Define secret path policies for agents
  4. 4Enable the pack and test credential issuance

Frequently asked questions

How does Cordum govern HashiCorp Vault actions?

Cordum evaluates every HashiCorp Vault action against your policy before execution. The Safety Kernel returns Allow, Deny, or Require Approval decisions, ensuring agents operate within approved boundaries.

Do I need to modify my existing HashiCorp Vault setup?

No. The Cordum HashiCorp Vault pack installs as an overlay. It intercepts agent actions at the governance layer without changing your existing HashiCorp Vault configuration.

What happens if an agent action is denied?

The action is blocked before execution, logged in the audit trail, and optionally triggers an alert. The agent receives a structured denial with the policy reason, so it can adjust its approach.

Ready to govern HashiCorp Vault?

Other integrations