TL;DR: Today we're launching Agentic Vault, a secrets vault built into identity governance. It secures the exposed credentials found by shadow AI discovery, governs every secret through the same request, approval, and audit process as other access, gives agents short-lived, scoped credentials instead of raw keys, protects them with post-quantum cryptography, and uses decoys to catch misuse as soon as it happens.
Introducing Agentic Vault# #
This is the second post in our C1 Launch Week series. Today, C1 is launching Agentic Vault. Every credential is a key to something. An API key, database password, or signing token gives an identity the power to act. Yesterday, shadow AI discovery found credentials running loose across your environment, including plaintext keys in config files on developer laptops. Finding them was the first step. Securing and governing them is the second.
Agentic Vault puts every secret through the same request, approval, and audit process as any other access decision, with post-quantum ready protection underneath. People, service accounts, and AI agents are all first-class holders of secrets, governed in the same way.
The challenge: secrets multiply at agent speed# #
Most identities in your environment are no longer human. Agents authenticate on their own, acquire credentials, and act at machine speed. But most vaults were built for a person checking out a password now and then. At agent scale, that often means handing out broad access and accepting the blast radius, or creating a vault for every credential and dealing with the resulting sprawl. Neither delivers least privilege.
The scale of the exposure is already measurable. GitGuardian's State of Secrets Sprawl 2026 found 28.65 million new secrets leaked on public GitHub in 2025, up 34% year over year, with leaked AI-service credentials up 81%.
The quantum clock is already running# #
There's a second pressure, and it's not hypothetical anymore. On June 22, 2026, the White House signed an executive order directing federal agencies to migrate to post-quantum cryptography. Credentials encrypted under today's standards can be harvested now and decrypted later, once quantum computers reach scale.
That reframes every secret you store today. A credential encrypted with legacy cryptography isn't just a present-tense risk. It's a future breach being collected in advance. Every organization running a legacy vault is accumulating that exposure right now, one stored secret at a time.
Every secret, governed like an identity# #
C1 addresses both problems: govern secrets as access, protect them with post-quantum cryptography, and issue agents scoped, expiring credentials on demand. It uses the same governance process as the rest of your identity program.
Credentials built for agents# #
An agent can't check out a password from a UI, and handing it a long-lived key isn't least privilege. Agentic Vault gives agents access as workload identities, rather than treating them like people using passwords.
Workload federation: short-lived, scoped credentials on demand#
Agents authenticate through workload federation. You define a trust condition, for example, any workload running as your production agent-runner. A workload with a matching signed identity can exchange it for a short-lived, scoped credential issued by C1. The agent uses that credential without ever holding a raw, reusable key; the vaulted value stays sealed. You can limit permissions, restrict the credential to an IP range, and require proof of possession, the same controls used for privileged human access, applied to a machine.
The agent never receives the raw, long-lived secret:
- It gets only a short-lived credential created for that moment. The vaulted secret stays out of the model's context, so a prompt-injected or compromised agent can't leak a key it was never given.
- Nothing long-lived remains. The credential is issued when needed and expires on its own, turning a leaked token into a small, closing window rather than an open door.
Engineers get the same protection. They request a just-in-time credential from the desktop app or CLI, use it, and let it expire. The secret never lands on the laptop, reducing endpoint risk rather than spreading it.
Post-quantum from day one# #
Every stored secret is already on a clock.
An attacker doesn't need a quantum computer today to benefit from one later. They can capture encrypted data now and decrypt it once the hardware matures: "harvest now, decrypt later." Ciphertext captured today may still contain secrets that haven't rotated when that hardware arrives, especially the long-lived secrets most worth vaulting.
Agentic Vault is post-quantum-hybrid from the start. Its key exchange is X-Wing: X25519 paired with ML-KEM-768, a NIST-standardized post-quantum algorithm. This protects the key material behind your secrets against future quantum attacks while maintaining classical security today. Most incumbent approaches, where available, add post-quantum protection at the transport layer through the TLS connection. C1 puts it in the vault's own key establishment, one layer deeper. You don't need to schedule a future migration; you start with that protection in place.
Decoys: protection built into Agentic Vault# #
A decoy is a credential issued by C1 that looks like a real one, a client ID and secret, an access token, or a federation trust, but belongs to no legitimate workload. You place it where an attacker or a curious agent might look, such as a .env
file, CI variable, or secrets manager. C1 gives you a fingerprint to record alongside its location.
If anyone tries to use the credential, a high-confidence "Decoy credential used" finding fires with the source IP, time, endpoint, and fingerprint identifying the planted secret. Agentic Vault provides decoys for the credential types used in agentic environments: human and service-principal credentials, connector credentials, workload-federation trusts, and access tokens. You can place them on the same surfaces where real secrets live.
One governed plane for every secret# #
Together, these capabilities create one governed process for every secret.
An exposed key on a laptop is brought into custody. Its replacement is governed like an identity: requested, approved, and audited. An agent gets a short-lived, scoped credential for the task, never the raw vaulted secret. Post-quantum ready right from day one. A decoy alerts you when someone reaches for a credential they shouldn't use.
That's what "fearless" looks like in practice. You don't have to slow agents down to stay safe or trade control for speed. The secure path and the fast path are the same path, so you can put agents to work on sensitive systems without widening the blast radius.
Yesterday you saw your shadow AI. Today you secured the credentials it runs on. Tomorrow we govern what your agents actually do at runtime, the tool calls they make and the data they touch. Then we bring every identity, risk, and response into one view. Four drops, one Agentic Control Plane.
Come put your secrets under governance — see credential security or talk to us at c1.ai. Adopt AI, fearlessly.
## FAQ[#](#faq)
### What exactly is Agentic Vault?[#](#what-exactly-is-agentic-vault)
A secrets vault built into the C1 identity platform. People, AI agents, and service accounts are all first-class secret holders. Every credential follows the same request, approval, policy, and audit process you already use for access, with post-quantum-hybrid key protection from day one.
What happens to the credentials shadow AI discovery found on endpoints?#
Vault-and-replace moves them into the vault and rewrites the config to use a managed reference native to the tool that owns the file, whether that's AWS, git, Docker, or an MCP-based tool. C1 first writes a redacted backup that never contains the plaintext, making the process reversible.
How is this different from a traditional secrets manager?#
Traditional vaults store secrets with governance added beside the identity system. In Agentic Vault, membership is the access control. Each vault is an encrypted group: granting access adds a member cryptographically, while removing access re-keys the group. There is no separate governance system to reconcile after an incident.
How do agents use secrets without ever holding them?#
Through workload federation. A matching workload exchanges its signed identity for a short-lived, scoped credential issued at the moment of use. The agent never holds the raw vaulted secret, so a compromised agent can't leak a key it was never given.
What are decoys for?#
They're identity-native honey credentials. A decoy authenticates against C1-monitored endpoints, making any use observable. Place one where a real secret would sit, and its use triggers a high-confidence "Decoy credential used" finding with the source, time, and fingerprint match. It's a clear signal that something is wrong and where.
Sources# #
- GitGuardian, State of Secrets Sprawl 2026: 28.65 million new secrets leaked on public GitHub in 2025, up 34% year over year, with leaked AI-service credentials up 81%.https://www.gitguardian.com/state-of-secrets-sprawl-report-2026 - Executive Order 14412, Securing the Nation Against Advanced Cryptographic Attacks, The White House, June 22, 2026.https://www.whitehouse.gov/presidential-actions/2026/06/securing-the-nation-against-advanced-cryptographic-attacks/