Credentials and vaults

Properties: V Named secrets, least privilege, VI Bounded blast radius, X Secret rotation is cheap
Goal: TODO
Done when: TODO
Restart from: lesson 3 (the lesson whose checkpoint to reload if this one breaks)
Mode: self-paced or live · about 20 min

Watch

TODO: video

hands-on self-paced live

Fountain merges environment secrets first and vault secrets second. The vault wins.
A vault binds to one conversation at creation. allowed_environment_ids and allowed_vault_ids limit what a caller may attach.
Mend keeps the read token in the repo’s vault and the write token in the browser. The sandbox never holds the write token.
Removing the vault revokes the credential. No rotation ceremony is needed.
The table of who holds which credential and what it can do is reused in Fountain lesson 8 and IAM lesson 12.

TODO: Video script or link. Optional.

TODO: Numbered steps. Imperative. One job.

TODO: What Floci or your own machine can and cannot show.

TODO: What the room sees. Timing. The line to say.