Every exposure of information is a transaction.

Several rules per folder. For example:

• Finance: only with your approval.
• Contracts: a copy without identifiers.
• Management: closed outside working hours.
• Customers: read yes, write no.

Everywhere else the agent works freely.

For each key in the vault you set what it does and what an agent may do with it:

• Not for agents.
• Only with your approval, per command.
• Up to a number of uses a day.
• Only at certain hours.

The policy is checked on both ways an agent asks the vault for a key: when it runs a command, and when it calls a prepared action.

The agent runs commands with the keys without seeing them, and the values are masked in the output too.

The admin writes a rule once and it reaches every computer in the organisation. A computer can tighten it, not loosen it.

A Claude Code hook. Before Read, Grep, Bash or Write it checks the file and folder rules, the scan findings and key files. Reading a .env, or searching folders that hold keys, is held before it runs, in other projects too.

nodata_rules add  path: "~/Finance"  effect: "ask"
nodata_rules add  path: "~/Finance"  effect: "deny"
                  when: [{ "field": "action", "op": "eq", "value": "write" }]

• Several rules per path. The most specific path decides.
• Allowing a path or removing a restriction needs a person's approval.

{ "does": ["generate"],
  "tz": "Asia/Jerusalem",
  "rules": [{ "when": [{ "field": "actor.kind", "op": "eq", "value": "agent" }],
              "effect": "deny" }] }

• Conditions: who, what the key does, project, hour, weekday and date.
• Outcomes: allow, approve, a daily cap, deny.

• nodata_run runs a command with the vault's keys, in memory only, and masks the values in the output. Each command is approved as written, and before approval it shows what each key will get.
• nodata_use: the server injects the key into a prepared action. The agent does not receive the key, and the key's policy is checked here too.

• nodata_expose gives a partner clean copies from a folder, for as long as the rule lives.
• nodata_send sends a link with an expiry, an open count, a code over a separate channel, and view-only if you want.
• Both can be revoked at any moment.