How Keyspout Moves a Secret to One Task

How Keyspout Moves a Secret to One Task A data-flow diagram generated by Archify. 01 / Actors 02 / Storage 03 / Use Administrator · writes value, sets policy · 01 / Actors Administrator writes value, sets policy Database password · a value granting access · 01 / Actors Database password a value granting access Alice · owns the secrets · 01 / Actors Alice owns the secrets Sealed record · ciphertext plus HPKE envelope · 02 / Storage Sealed record ciphertext plus HPKE envelope Storage backend · local disk, S3 or Valkey · 02 / Storage Storage backend local disk, S3 or Valkey Audit log · records who received what · 02 / Storage Audit log records who received what Task agent · holds its own keypair · 03 / Use Task agent holds its own keypair Task run · one database check · 03 / Use Task run one database check shares it encrypted sealed write policy: she may share it policy locked with a fresh key encryption stored as one record durable write shares one secret for this task bounded grant reads it, unlocks with its key durable read value in child env, this run runtime delivery proof of possession + use report attribution record Legend primary data policy / PII async batch data store