Agent Credential Vault

Today, when users hand credentials to AI agents, they have two options: paste an API key into the agent's config, or grant full account access via OAuth. Once handed over, control is lost — users don't know which credentials the agent used, what resources it accessed, or whether it passed credentials to downstream agents.