2AYE VAULT / PUBLIC PREVIEW
Keep every boundary visible.
The intended architecture separates identity, decryption and authority to act.
Account → vault permission
Shared identity establishes who is signed in. Vault permission must still be checked for the requested vault.
Permission → unlock
Permission to retrieve encrypted data is separate from the key needed to decrypt it. No key is distributed by this preview.
Selection → destination
Credential use needs explicit selection and destination checks. Agent operations need their own exact-action authorization at the protected resource.