Audit logging and anomaly detection

Agent Vault puts the secret in the proxy and the trust boundary in a route table

Infisical's HTTP credential proxy keeps API keys out of prompts and logs without touching agent code. How much it actually narrows depends on how tightly the route patterns are written.