Threat model
| Threat | Protection | Boundary |
|---|---|---|
| Theft of the ciphertext database | Client encryption and key separation | Structural metadata may remain visible; password and KDF strength matter. |
| Substitution across vaults or Agents | Signatures and independent binding verification | Does not protect against executing a malicious client. |
| Agent requests excessive access | User decision, GRANULAR, method and time limits | Approving an unsafe scope remains a trust decision. |
| Prompt injection induces credential use | Authorization outside the model and minimal scope | Palladin cannot reliably infer model intent or detect every harmful task. |
| Malicious Exec target process | Model separation and controlled delivery | The process receives the secret and can use or disclose it. |
| Site script reads a filled form | Exact host and document checks before writing | The destination site can observe data in its DOM. |
| Malicious same-user process | Tier- and OS-dependent protection | Convenience does not isolate the entire same-user environment. |
| Administrator/root reads memory | Lifetime minimization and platform controls | A compromised device is outside the server-encryption guarantee. |
| Revoked recipient retained data | Block new delivery and rotate | Earlier knowledge cannot be revoked. |
FULL requires trust
FULL delivers the Vault Key (VK) to the agent’s local program. Single-entry API responses, expiry, and usage counters are online controls. They do not establish cryptographic isolation from the rest of a vault against a malicious VK holder.
Distribution is part of security
A modified launcher, runtime, web client, or provider can change system behavior. Signatures, artifact provenance, and version compatibility belong to the security model, not just installation. Missing required evidence should block sensitive operations.
What “no secret in the model” means
It applies to a particular delivery path. It does not cover Get, explicitly returned Script results, or data later read from the target process or site. Hiding a value from the model does not remove the risk of an unwanted operation using that value.