Agentic FabriqCall-time injection, server-side.
The credential attaches on Fabriq’s side; the agent sees results, never secrets.
PLATFORM / Credential Vault
The agent calls the tool. The secret never leaves the vault.
Credentials are injected server-side at call time — nothing to leak, paste, or commit.
01 / IDENTITY02 / POLICY03 / AUDIT
01 / THE CONTEXTThe credential never
The credential never
enters the agent.
An agent that holds a credential holds all of its power — and today, agents hold credentials everywhere.
Google Drive4m ago•••• •••• •••• •••• OAuth token
Gmail22m ago•••• •••• •••• •••• OAuth token
Slack1h ago•••• •••• •••• •••• Bot token
GitHubyesterday•••• •••• •••• •••• Access token
Salesforce3d ago•••• •••• •••• •••• OAuth token
Held in the vault, attached to the call on Fabriq’s side. The agent gets the result back — never the secret.
02 / IN PRACTICE
All the power. None of the secrets.
ONE CREDENTIAL · THREE CALLSIllustrative · ap-agent acting for a Finance analyst
OAUTH TOKEN
•••• •••• •••• ••••held in the vault · never rendered, never returned- held bythe vault
- seen by the agentnever
- attachedserver-side, per call
- removed withthe connection
- Read an approved invoiceAllowed
netsuite.invoice.readap-agentAttachedNSNetSuiteFabriq attaches the stored token on its own side, calls NetSuite, and hands back only the result. The agent process never saw a secret.
- Use a revoked connectionBlocked
gmail.sendap-agentNothing to attachGmailThe connection was removed, so its token was deleted with it. There is no credential left to inject and the call fails at the vault, not at Gmail.
- Release a paymentHeld
netsuite.payment.releaseap-agentWaitingNSNetSuiteA named human approver has to say yes first. The credential stays where it is until someone does — nothing is attached to a call that has not been approved.
Illustrative calls · the secret is attached on Fabriq’s side and every use lands on the audit trail with both identities.
03 / WHAT CHANGES
Control, in the details.
Auto-refresh before expiry.
Tokens renew themselves, so workflows never stall on auth.
Disconnect cuts access at the vault.
Removing a connection deletes its token — nothing runs on a stale grant.
Last-used tracking.
Stale credentials are visible, so they get retired instead of forgotten.
Nothing to paste or commit.
No key in the prompt, the code, or the repo — the agent never had one.
Every use is on the record.
Each call a credential powers lands in the audit trail with both identities attached.
CONNECTION CONTROL
The credential stays behind.
ap-bot-01
holds: nothing
⬡ Agentic Fabriqvault · tokens & secrets
NetSuite
sees: a signed call
THE CREDENTIAL IS INJECTED SERVER-SIDE AT CALL TIME — THE AGENT NEVER HOLDS IT
THREE LAYERS. ONE DECISION.
The boundary travels with the work.
Explore the context attached to every request.
What is this agent allowed to do?
ap-agent has a defined purpose and a bounded set of tools.
Whose authority travels with it?
The request acts for finance analyst, using that person’s permissions.
Where does the action land?
The policy applies to the requested action within NetSuite, before the tool executes.
QUESTIONS
A closer look.
Where do the secrets actually live?+
In a dedicated vault. In the standard brokered mode, credentials are injected server-side per call — the agent process never holds one.
Do tokens expire mid-workflow?+
No — a refresh worker renews tokens before they expire, so long-running workflows never break on auth.
Do agents ever see raw tokens?+
Not in the standard brokered mode — credentials attach server-side and the agent only ever sees results. Teams that need direct token access can opt in explicitly.
What if an agent is compromised?+
The attacker gets an agent, not a credential — there’s no token on the agent’s side to steal, and its access revokes in one action.
How does rotation work?+
OAuth tokens renew themselves before expiry, and because secrets live in one vault, replacing one is a single central update — not a hunt across laptops and repos.