Platform · sealed

Sealed — every customer secret, scoped and scrubbed.

Per-CLI workload identity, vault-backed secrets, redaction at the host RPC seam, audit on every read. Customer keys live in the sandbox only — encrypted at rest, JIT-resolved, scrubbed on release. The credential model your security review will sign.

from sagewai.sealed import Profile

acme = Profile("acme-prod").set_secret("OPENAI_API_KEY", "sk-...")
agent = Agent(profile=acme)
agent.run(task)  # key only in the sandbox; auto-redacted, auto-audited

The rest of the platform