Raw secret blocking
Persistent, scratch, episodic, feedback, proposal, and MCP write paths reject detected raw keys, private keys, bearer tokens, and connection strings.
Security posture
Secrets are not memory.
caveauMEM blocks raw secrets in write paths and stores only references such as `vault_key:`, `secret_ref:`, or `env:`. Admin access is powerful, explicit, and auditable.
Security controls
Data classes
Migration 004 adds public, internal, confidential, personal, sensitive personal, and secret-reference classification.
Scoped owners
Tokens can be constrained by namespace, owner scope, and data class so Hermes and other agents never need admin tokens.
Admin audit
Admin read is a policy flag, not a casual bypass. Audit records exist for read, write, copy, redact, promote, exchange, import, and admin read events.
Exchange safety
Memories can move between scopes through copy, redact, promote, and exchange-package flows with provenance.
Break-glass custody
Top-secret recovery material belongs on encrypted offline media or a hardware token, not in memory, prompts, logs, or support bundles.
Hermes beta rule
Hermes integration stays beta until provider registration and SDK behavior are verified. Each Hermes agent gets a scoped token for its namespace and owner scope. Admin tokens are never issued to routine agent runtimes.
