cloister

A tool's reach, cut down to what it was granted — first the credential, then the whole process.

3 parts

A tool holding your API key can be told to leak it by anything it reads. But it never needed to hold the key — only to have it used on its behalf. So give it the call, not the key.
What makes that hold is the runtime, not the tool's good behavior: each tool runs in an isolate reaching the vault across a binding it cannot forge. Prompt injection can rewrite a tool's intentions, not its address space.
The most exposed process is the coding agent itself, so it gets confined at the kernel — $HOME closed, network blocked but for the credential proxy, EPERM from the kernel rather than a policy it agreed to.
Declared policy and enforced policy are read from one source, and the runtime refuses to confine anything at all when the manifest hash does not match the certificate.
Proving a denial takes as much care as proving an allow: empty output does not count, a missing file does not count, and the decoy secret is planted outside the directory the sandbox default-allows.

AI;DR

Give Tools Calls, Not Keys
A compromised tool should have nothing to leak — because it was never handed the secret in the first place, only the call.
Jul 14, 2026 · 5 min read
Kernel, Not Convention
cloister doesn't stop at keeping secrets out of a tool's hands. It confines the whole process — filesystem, network, everything — and the kernel enforces the line, not a policy the process agreed to follow.
Jul 20, 2026 · 4 min read
The Credential Is Part of the Interface
ACI got the shape of the call right and left the authority behind it alone. A tool reached three ways has three different credential stories, and the oldest one — ambient secrets in your home directory — is the one agents break.
Aug 3, 2026 · 8 min read