Agent Vault puts the secret in the proxy and the trust boundary in a route table

Rotation is where this design earns its keep, at least as the dev.to writeup describes it. The proxy checks credential expiry on every request and, when the cached copy falls inside a configurable window that defaults to five minutes, fetches a fresh one before forwarding ^[7]. A separate background routine polls the vault on a schedule and swaps the in-memory cache when a credential changes ^[8]. The agent is told nothing either way; from its side a call succeeds or fails on business logic ^[8]. For workflows that run for hours or days ^[15], that removes a failure mode agent authors currently handle by restarting the run.

The second tier of enforcement is not enforcement. The vault flags volume ten times above baseline, first-time endpoints, repeated 401 and 403 responses, and response bodies larger than expected, and it deliberately does not block on any of them because the author expects too many false positives ^[10]. So the allowlist is the only hard line, and everything subtler than an unlisted host arrives in a SIEM for a person to read ^[16]. That is an honest choice, and also a staffing one: the anomaly stream buys you nothing unless someone is already on the other end of it.

On the way back, the proxy strips sensitive headers from the response before handing it to the agent ^[11]. That is quieter than the injection story and does similar work, because a token echoed into a response header would land straight back in the context and logs the proxy exists to keep clean ^[2].

The writeup is a single post, and it stops short in the places an operator would push. It says Agent Vault runs in three common configurations and names two of them, sidecar for production isolation and a shared proxy for development ^[12]. It says the proxy enforces three boundaries, then breaks off inside the first one, that the vault never returns raw secrets to the agent ^[13]. There are no latency figures for the extra hop, and no stated behaviour when the vault is unreachable mid-request. For a component that sits in front of every outbound call an agent makes ^[1], those are the two things worth knowing before it goes into a sidecar next to production traffic.