AI agents and Passwords

An AI agent that works on a workstation sometimes needs a login, an API token or an SSH key. Passwords lets it use one, with your permission, for the length of one workstation session. The agent never sees the value.

Giving an agent Use access

Open a shared vault, then ⋯ → Share… and choose Add people, teams or roles. AI agents appear in the list with the AI tag. Add the agent at Use only. The permission is fixed, so there is nothing to choose, and the agent’s row reads “Can use with a grant”.

Use only does not open anything by itself. It means the agent may ask, and that someone who can open the vault may then grant it access.

Agents cannot be added to Private vaults. They can only be added to shared vaults, and only at Use only: they cannot view, edit or manage a vault.

When an agent asks

When an agent needs something from a vault, it sends a request with a short reason. The request names items by id, so 3mote does not store the titles of the items the agent asks for; your own device decrypts the titles it shows you. The reason is the agent’s own free text, so it is stored readable and may name items. You are notified if you are the person it is working for, and so are people who can open that vault. Select the notification to open the request.

The request page shows:

which agent is asking, who it is working for, and the card it is working on;
the reason, in a muted box labelled Written by the agent. This is the agent’s own text, shown as plain text, so read it as you would any message from someone you do not yet know;
a line, The agent asked for:, listing what the agent named. Nothing is ticked for you: the items in the vault are listed with titles decrypted on your device, the ones the agent named are tagged Requested, and you tick the ones to grant;
Workstation verified when your device has confirmed that the request comes from the agent’s real workstation session.

Choose Grant for this session or Decline. If your device is locked, unlock it first. If the request is already closed, or you cannot open the vault, the page says so instead.

What granting means

Granting lets the agent use the items you ticked until its workstation session ends. Your device prepares the access and sends it so that only that one workstation can open it.

The values stay on the workstation. They are applied for the agent, for example added to a web request to an allowed address, loaded into a key agent, or typed into a sign-in form, and are never shown to the agent or sent to its AI provider.
The agent can see the titles of items it has been granted or has asked about, and nothing else. Titles reach the AI provider your workspace chose for that agent; values never do.
Granting does not change who the vault is encrypted for. In an ordinary shared vault, 3mote still cannot read it. (An Automation vault is different.)
The agent acts for the person it is working for. If that person or you lose access to the vault, the grant stops working.

A grant is for one session. When the session ends or the workstation moves to a new machine, access is removed and the agent has to ask again. Changing or deleting an item also removes grants for it.

Taking access back

Open the vault, the card, or the agent’s Runs tab to see Agent access: one line for each request, such as “Nova can use 3 items from Ops · granted by Maya”, with the time it ends. Select Show items to see each item (its title if your device can open it, otherwise what kind of item it is and when it was granted). Select Revoke on an item, or Revoke all for the request, to end access straight away. Where you are allowed to stop the workstation, Revoke and stop workstation also ends the session.

Revoking stops the agent using the value from then on. It cannot make an agent forget a value it has already used in a request or a session. Rotating the password, key or token at the website is the only certain way to take back a value an agent has used.

The vault’s Activity records requests, grants, declines, revocations and each time a value was applied, with the address it was used for.

Automation vaults

A grant needs a person to approve each request. For work that has to happen with nobody there, such as an overnight task, a shared vault can be made an Automation vault: agents with Use only access can use its items at any time, without asking. It is opened by a key that 3mote holds, so it is not zero-knowledge. See Automation vaults.

What an agent cannot do

It cannot open Private vaults.
It cannot view, edit, share or manage a vault, or see an item’s password, key or token.
It cannot be granted more than Use only.
If its output carries a value it should not have, that output is withheld and replaced with a notice. After three withheld outputs in one session, the workstation stops the session.
If the same item is caught three times in a week, across all agents, it is paused for every agent until a manager of the vault clears it. The vault’s managers are notified, and the item shows Agents are paused on this item. To clear it, a manager selects Allow agents again, after changing the value at the service it belongs to.
It cannot use an item at addresses the item does not list (set Allowed hosts on the item), or reach a connected code host this way.
Pasting a password into a chat or a card for an agent bypasses all of this. Ask the agent to request access instead.

What a grant can’t protect against

A grant controls what the agent is allowed to use. It cannot control what happens to a value once it has been used for something you allowed.

A site that echoes the key back. If an agent sends a password or token to a website that repeats it in its reply, the value is in that reply. 3mote withholds output it recognises as a granted value, but it cannot catch every way a site might show it, so only grant access at addresses you trust.
Screenshots. A screenshot of a page is not scanned. If a value ends up visible on a page, a screenshot of that page shows it.
Sessions and tokens created during the grant. Signing in can start a web session, and a service can issue a new token. Revoking the grant does not end those. They last until they expire or you end them at the service.
Withholding is a small leak by itself. Each withheld output tells an agent that holds a value that it contained that value. Stopping the session after three, and pausing the item after three in a week, keeps that to a few characters, which is why a manager should change the value before allowing agents again.
Rotating the password is the only certain revoke. Revoking stops further use. Changing the password, key or token at the service is the only way to be sure a value the agent used can no longer be used.