Asiri
Login Get CLI
Use cases

Start where a secret is already being copied by hand.

Asiri earns its place when the same credential keeps moving between a laptop, an agent, CI, a container, a server, and a dashboard. Keep the policy central. Keep use local. Use strict audit when administrators need to see critical access before the value is released.

Pick the first route

Choose the workflow that already leaks.

Start with the route that has copied keys, shared env files, or one-off deploy tokens. One narrow grant is enough to prove the model.

01

Agent work on a developer laptop

A coding agent needs to run tests or setup scripts against an API. Trust the device, authenticate the user or service account, and let the runtime inject without placing the value in a prompt or .env.

asiri env --workspace peter-oclan-co --label codex dev/openai/OPENAI_API_KEY -- npm test
02

Agents using SSH or deploy secrets

An agent needs to reach another machine to inspect logs, deploy a fix, or run a maintenance command. Put the SSH or deploy secret in a strict production envelope so the control plane acks the access before the runtime exposes it.

asiri mount --workspace oclan-co --label codex prod/ssh/DEPLOY_KEY -- ssh app-prod
03

CI and deploy automation

A runner needs deploy credentials for a short window. Enroll the runner as a trusted device, authenticate it as a narrowly granted service account, and revoke device trust when the runner is replaced. Rotation happens from one place.

asiri service-account grant --workspace oclan-co --service-account ci --scope prod/deploy --secret DEPLOY_TOKEN --inject-only
04

Env vars and Docker-style files

An app already expects environment variables or secret files. Export a direct envelope as env vars, or materialize 0600 temporary files the child reads — no platform-specific secret wiring, no static copies to rotate.

asiri env --workspace peter-oclan-co dev/cloudflare -- npm start
05

Servers with local broker access

A service needs repeated local use. Bind a broker to loopback, grant only the scopes its service account needs, and log each allowed or denied request. A separate label may describe the workload in audit records.

asiri broker start --workspace oclan-co --label prod-api
Decision guide

Do less first.

Start with one reversible secret and one action. Expand only after audit, revocation, and human approval feel boring. This table matches the leak you have today to the first Asiri move.

Copied .env filesUse env export or file mounting on one development envelope.
Agents seeing raw keysUse environment injection or broker access through an authenticated identity on a trusted device. Labels are audit-only.
Production SSH/API accessSet the envelope to strict so administrators see the access before the value is released.
CI sprawlEnroll the runner as a device and keep expiry short.
Server replacementRevoke old device trust and rotate upstream credentials after suspected exposure.
Roll out one capability at a time

The same six steps, every time.

Asiri narrows blast radius. It still assumes hosts can be compromised, grants can be wrong, and rotation is sometimes the right answer.

  1. 01
    Name the envelope and secret
    Example: dev/openai/OPENAI_API_KEY in workspace peter-oclan-co, or prod/stripe/STRIPE_SECRET_KEY in workspace oclan-co.
  2. 02
    Approve the device
    The private key stays local. The human owns trust and recovery.
  3. 03
    Use the safest delivery method
    Prefer inject, mount, broker, or sidecar so plaintext stays out of agent context.
  4. 04
    Pick the audit mode
    Use buffered when offline local work matters. Use strict when release should wait for a control-plane ack.
  5. 05
    Revoke and rotate when needed
    Replace trust and rotate upstream credentials after suspected exposure.
  6. 06
    Keep the audit boring
    Check identity, device, optional audit label, reason, and sync state before expanding scope.
Run the CLI loop Review the product model