Vault as an access boundary

Folders and CLI toggles are the main safety controls.

Vault Team/API Production CLI on CLI off = app-only

Prefer references

Put authsia:// refs in scripts and env files. Secrets resolve only at approved runtime.

SSH via the agent

Git and SSH should sign through Authsia’s agent — not by exporting private keys into the shell. See Secure SSH & Git.

Copy Path stays shell-ready

Copy Path yields export NAME='authsia://…' so pasted refs stay visible to child commands.