Agent Security and Blast Radius

Cursor cloud agents can mint their own Vault login, and the static token goes away

A dev.to walkthrough wires Cursor's local OIDC socket to Vault's JWT auth. The resulting credential chain tops out at 35 minutes, and the KV mount is still the only real boundary.