AppsSecurity & Compliance

Secrets management

Sealed secrets and two-person reveal

Autessa secrets are either Sealed, which no one can ever view, not the owner, not an admin, not support, or Revealable, which can be viewed once after a different manager approves a request with a reason. Automation can never reveal a value, even with an approved request, and Seal forever turns a Revealable secret Sealed for good.

Start free
Reveal request · vendor-portalRevealableSample
  1. 1Request · Priya · Reveal access“Re-entering the vendor portal password after the laptop swap.”
  2. 2Approve · Sam · Manage access (not Priya)Nobody can approve their own request
  3. 3View once · Priya, signed inWithin 15 minutes · then the request is used up
MACHINE_IDENTITY_CANNOT_REVEAL

Keys, scripts, apps and scheduled runs are always refused, even with an approved request.

The problem

What problem does it solve?

Some credentials have no other copy, such as a shared account password, so someone may genuinely need to read them. That should never be a single person acting alone, and never a script.

How it works

  1. 1

    Request

    Someone with Reveal access asks to see the value and gives a reason, up to 500 characters.

  2. 2

    Approve

    A different person with Manage access approves or denies. Nobody can approve their own request, including the owner. Undecided requests expire after 7 days.

  3. 3

    View once

    Within 15 minutes of approval, the requester views the value once, in the builder or with autessa secrets reveal, signed in as themselves.

  4. 4

    Check again at view time

    If their Reveal access was removed after approval, the value is not shown. A manager can also deny an approved request not yet used.

Every option

Sealed secrets and two-person reveal: settings and options

SettingWhat it does
SealedUsable by tools, never viewable.
RevealableViewable once per approved request.
Seal foreverIrreversible. Cancels open reveal requests.
Request lifetimesPending: 7 days. Approved: 15 minutes.

Permissions

Who can do what?

WhoWhat they can do
RevealRequest to see a Revealable value; cancel their own pending request.
ManageApprove or deny others’ requests, never their own.
Machine identitiesNever reveal: poweruser keys, client keys, script identities, public app site keys and scheduled or triggered runs get MACHINE_IDENTITY_CANNOT_REVEAL.

FOR DEVELOPERS

Reveal flow · CLIbash
autessa secrets reveal-request --secretId <id> --reason "Rotating the vendor portal login"
autessa secrets reveal-requests --scope TO_APPROVE
autessa secrets reveal-approve --requestId <requestId>   # a different manager
autessa secrets reveal --requestId <requestId>           # once, within 15 minutes

What to know

  • Give Manage to at least two people on a Revealable secret, so one can approve the other’s requests.

Read the docs: Reveal requests →

Connections

How Sealed secrets and two-person reveal connects to the rest of Autessa

Secret rotation and audit log →

REVEAL_REQUEST, REVEAL_APPROVE, REVEAL_DENY and REVEAL events.

Secrets vault →

Choosing Sealed or Revealable at creation.

Reports, policies and security questionnaires are on the Autessa Trust Center.

FAQ

Sealed secrets and two-person reveal: questions

Can Autessa support see my sealed secrets?

No. A Sealed secret cannot be viewed by anyone: not the owner, not an admin, not support.

Can the owner reveal a secret without approval?

No. Nobody can approve their own request, including the owner.

Can I turn a Sealed secret back into Revealable?

No. Sealing is one-way.

Get started with Sealed secrets and two-person reveal

Sealed secrets can never be seen by the owner, an admin or support; a Revealable secret is shown once, only after a second person approves a request, and automation can never reveal at all.

Start free

Reports, policies and questionnaires live on the Autessa Trust Center.

100% customizable, code and all

Make Autessa Security & Compliance fully your own.

Use it out of the box, then change anything. Ask Autobot, Autessa’s AI builder, for a new field, screen, report, workflow or agent and it builds it into your copy of the app. Or open the code and edit it yourself. Nothing is locked: the app, its data and its code are yours.

Start free and make it yours