> ## Documentation Index
> Fetch the complete documentation index at: https://docs.inviolet.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Credential broker

> Integrates with your existing PAM so credentials release only when an Inviolet mandate is presented.

Inviolet sits beside your existing PAM — Vault, CyberArk, Conjur, BeyondTrust,
Delinea, Teleport. The Mandate Issuer mints intent-bound JWTs; your credential
broker mints destination credentials. The two integrate so the broker only
releases credentials when an Inviolet mandate is presented.

## Supported brokers

| Broker          | Subcategory             | Tier        | Status   |
| --------------- | ----------------------- | ----------- | -------- |
| HashiCorp Vault | Secrets management      | Deep Violet | Live     |
| CyberArk Conjur | Open-source PAM         | Ultraviolet | Live     |
| CyberArk Cloud  | PAM                     | Ultraviolet | Live     |
| Teleport        | Zero-trust access proxy | Ultraviolet | Live     |
| StrongDM        | Zero-trust access proxy | Ultraviolet | Live     |
| BeyondTrust     | Session broker          | Ultraviolet | Scaffold |
| Delinea         | Secrets management      | Ultraviolet | Scaffold |

## How the integration works

1. You configure your broker (e.g. Vault) with `auth-jwt` pointing at Inviolet's
   published JWKS: `https://api.inviolet.ai/v1/mandate/jwks`.
2. Map mandate `intent_id` claims to broker roles. A Vault role
   `postgres-readonly` might be bound to `intents:customer_support_lookup`.
3. When your agent needs a credential, call `/v1/mandate/dispense` with
   `broker_dispense: { kind: 'vault', vault_role: 'postgres-readonly' }`.
4. The gateway signs the mandate, forwards it to Vault, and returns both the
   mandate JWT + the resulting Vault token in one response.
5. When you revoke the mandate, Inviolet propagates the revocation to Vault
   automatically.

## What it catches

The agent never holds the real credential. Even a fully compromised agent —
prompt-injected, tool-poisoned, jailbroken — cannot exfiltrate what it never
received. See [Principle 5](/concepts/principles#principle-5).

## Inviolet vs. PAM — division of labor

* **Your PAM** stays the system of record for credentials, rotation policy, and
  audit obligations.
* **Inviolet** is the intent-aware broker in front of it — translating a
  declared intent + a column-grain policy into the right short-lived lease.