An app in a vault runs against the vault without ever being handed a key

A vault can contain an application, not only documents, and the application runs against the vault without ever holding a credential: it declares permissions of nothing, the host reads the vault and passes results in, and the app never sees a key. Capability without credential means you can run code you did not write against data you care about, with the blast radius set by a config file you can read in one screen. The same shape holds for a model: the key lives below the permission floor, the host makes the call, and the app never sees it.

Decided by. Nobody yet: a candidate for Dinis to read, comment on and decide (keep, rewrite, merge, cut, article first, later, not doing it).

Note. Belongs beside mandate-reach-gap: the config file is the written reach, enforced by the host rather than hoped for in a prompt. The chat article's qualification applies: the bridge protects the key it was trusted with; it does not yet stop a malicious app calling a provider with a credential of its own.

Where it comes from

Git for things you cannot put on GitHub The part that surprises people (newsroom)
A chat box on a site with no server, the plan, and the trade it makes Tier 2, the bridge (newsroom)

What it answers in the 2018 book

none named

Where it goes

Chapter Privacy by design: SG/Send, sgit, and the value of constraints, part Build it without a server (drafting); topic Controlling your agent: mandate, reach and hope versus enforcement.

Other ideas proposed for the same chapter: Git for things you cannot put on GitHub: what an encrypted vault is, One string is address, authorisation and key; the read key derived from it is safe to publish, Encryption on the client moves the problem from the data to the keys, and the sovereignty line to whoever holds them, Where the keys live: a password manager for the keys a person holds, a registry vault for the keys agents make, Append lanes: one POST from anywhere, readable only by the vault's owner, Nobody buys it for the encryption: the features came from the constraint, Client-side encryption reduces the exposure under GDPR; it does not take you out of it.

Node idea:capability-without-credential in graph.json; see it in the graph. Source: admin/content/graph/ideas.json.