# Using a secret

> Palladin documentation · 1.0 · EN · 2026-10-25


## Get: deliberate disclosure

The runtime decrypts approved data and returns it to the caller. If the caller is a model, plaintext enters its context. This path must not be described as hiding secrets from AI.

<figure class="doc-diagram"><ol><li>Ciphertext</li><li>Runtime: decrypt</li><li>Caller / model: plaintext</li></ol><figcaption>Get discloses permitted data to its recipient.</figcaption></figure>

## Exec: use in a process

The runtime supplies required fields through the target process environment, not command arguments. The standard model response is limited to status; child output is withheld. The target process nevertheless receives the secret and must be trusted for the task.

<figure class="doc-diagram"><ol><li>Model: program + arguments</li><li>Runtime: local decryption</li><li>Process: credential in env</li><li>Model: status</li></ol><figcaption>Exec separates the model from data supplied to the process. The process remains inside the trust boundary.</figcaption></figure>

For Script entries, returning the script result to the agent is a separate option. The result may disclose data, including encoded or transformed values. Enable it only for a trusted script and a deliberately selected result.

## Inject: use in a browser

The local Palladin program sends the secret to the browser integration over a protected connection. Before filling the form, it checks the HTTPS address, tab, current page, and selected entry. The model receives the operation result without field values.

<figure class="doc-diagram"><ol><li>Runtime</li><li>Authenticated channel</li><li>Verified HTTPS form</li><li>Destination site: plaintext</li></ol><figcaption>After filling, scripts on the destination site may read the values.</figcaption></figure>

Inject requires a compatible browser integration and an authenticated channel to the runtime. An extension ID alone does not prove store provenance. An unavailable provider ends the operation; it never automatically enables Get.

## Data lifetime

The runtime limits plaintext lifetime and copies. It does not cache delivered credentials between calls. This does not protect against privileged memory inspection. Unix Script execution has a controlled exception: a private temporary source file removed during cleanup. Details depend on the platform and artifact.