A short-lived agent grant: an ephemeral identity with read access to a
narrow set of keys. The grant’s pubkey is also a Vault::recipients
entry, and each granted key carries a scoped ciphertext under that pubkey —
so the agent’s access is governed (and MAC-covered) by the scoped entries.
This record is the audit/TTL layer: it lives in the encrypted meta (so an
agent’s existence and scope don’t leak) and is covered by the keyed MAC
(blake3v5:) so TTL, scope, and issuer cannot be tampered with undetected.
Agent access policy: machine-enforceable guardrails that travel with the
vault. This is NOT access control — every recipient can read every shared
secret by design, and an insider can use age directly or an old murk binary.
Its value is constraining what the murk binary will expose to agents (CI,
AI coding agents), enforced at the agent entry points (agent exec,
agent grant). Lives in the plaintext header and is MAC-covered so it can’t
be silently weakened.