Covey
Sign in

Identity & secrets

One of the load-bearing guard-rails: no long-lived secrets in the sandbox.

Broker access at runtime

Instead of giving an agent a permanent password, the secrets broker issues short-lived, scoped access tokens — for the task, for its duration.

Crypto primitives yes, protocols no

Covey signs JWTs, encrypts with AES-GCM and hashes passwords with Argon2id — using proven libraries. But it does not rebuild an OAuth/OIDC server; an external provider does that.

Pluggable ports
  • IdentityProvider — builtin (JWT/Argon2id) ↔ OIDC
  • SecretStore — builtin (AES-GCM columns in Postgres) ↔ Vault
Human roles & RBAC

People authenticate (SSO possible) and carry finely scoped roles: platform admin, agent owner, security/compliance, auditor, controlling. Every action is org-scoped.