Skip to main content
Inviolet sits beside your existing PAM — Vault, CyberArk, Conjur, BeyondTrust, Delinea, Teleport. The Mandate Issuer mints intent-bound JWTs; your credential broker mints destination credentials. The two integrate so the broker only releases credentials when an Inviolet mandate is presented.

​
Supported brokers

​
How the integration works

  1. You configure your broker (e.g. Vault) with auth-jwt pointing at Inviolet’s published JWKS: https://api.inviolet.ai/v1/mandate/jwks.
  2. Map mandate intent_id claims to broker roles. A Vault role postgres-readonly might be bound to intents:customer_support_lookup.
  3. When your agent needs a credential, call /v1/mandate/dispense with broker_dispense: { kind: 'vault', vault_role: 'postgres-readonly' }.
  4. The gateway signs the mandate, forwards it to Vault, and returns both the mandate JWT + the resulting Vault token in one response.
  5. When you revoke the mandate, Inviolet propagates the revocation to Vault automatically.

​
What it catches

The agent never holds the real credential. Even a fully compromised agent — prompt-injected, tool-poisoned, jailbroken — cannot exfiltrate what it never received. See Principle 5.

​
Inviolet vs. PAM — division of labor

  • Your PAM stays the system of record for credentials, rotation policy, and audit obligations.
  • Inviolet is the intent-aware broker in front of it — translating a declared intent + a column-grain policy into the right short-lived lease.