Vault and sandboxing

The vault is where your secrets live: API keys, passwords, private keys, certificates and secure notes, encrypted inside your own installation. Stored values are never displayed anywhere in Player One, not to an agent and not to you.

What an agent gets instead is a reference: a handle that names the item and carries neither the value nor permission to use it. When a command needs the real key, Player One puts the value inside that one process alone and strips it from anything the command prints back. The agent runs the work and reads the result; it never reads the secret.

How a secret gets in

You can add one yourself with Add secure item. Give it a clear name, description and a few aliases, because that is what an agent searches when it goes looking months later.

More often the agent asks. Say "here is the API key for the courier account" and rather than take it as chat text it opens a masked field: your browser sends the value straight to the vault and hands the agent back only the reference. Tick Save permanently and it stays for next time. Player One can also generate a secret nobody holds yet, such as a token two of your systems will share, and store it without anyone typing it.

Who can use what

Access is granted per item, per agent and per project. The agent that created an item can use it in that project straight away. Anything wider is your decision: share it with a project, with a named agent, or with an agent across all projects including ones you have not made yet. A block on one agent beats a broader share, and Only operators can share locks an item so no grant on it moves without you.

When an agent needs something it has not been given, it asks and stops. The request waits for you on its own tab, and arrives as a card in the chat that raised it and in the notification bell, so you can decide where you were asked. You see who is asking, what they would get, in which project and for how long, before you answer, and either way that conversation picks up again.

Sharing history is kept as a record you cannot edit, and beside it a log of every use with the values redacted. Removing access blocks future use, though a value already handed to a running process cannot be pulled back.

For a site that wants a human rather than a key, ask Player One to sign you in and a secure browser window opens beside the chat where you type the password and any two-factor code yourself; Log in for it once, let it work from then on has the steps.

What a sandboxed agent is

An agent you put in front of customers is sandboxed, and the vault is the first thing it does not get.

It knows only what you gave it: the role you wrote, its own instructions, and whatever knowledge or files you deliberately shared, read-only. It has no vault access, no shell, no general web or internal search, no sight of your other chats, files or agents. It cannot widen its own permissions, add a capability or edit itself, and you cannot put it on the team either: never a worker, never in a job, a delegation chain or a team-chat thread.

It answers from what it can read, asks the customer for missing detail, tells you when something needs you, and writes suggestions for you to review. To touch a real system it needs a narrow tool you build for that one purpose, with fixed inputs, a fixed destination and only the fields you allow coming back. The credentials that tool needs stay on your side of the wall.

That is what makes it safe to hand a stranger: a message trying to talk it into something finds nothing to reach. Grow your staff covers building one, and Create a support agent for your customers walks it through.

Where they live

Admin > Vault (/admin/vault) has three tabs, each its own page.

• Items (/admin/vault/items) is the inventory, searched across names, descriptions, tags and aliases. Opening one shows its sharing and everyone who currently has access.
• Requests (/admin/vault/requests) holds the sharing decisions waiting for you.
• Activity (/admin/vault/activity) is the history and the audit.

Sandboxed agents have no separate page: they sit with the rest under Manage > Agents (/agents), each with its own page where you edit its knowledge and its tools; the channel customers reach it on is set with your assistant when you connect that channel, and a public link for your website is opened on Admin > Agent Sharing: see Share an agent.

Stay in control puts this beside the other things you decide, and Agents covers the ordinary kind.