steve 2bc2c1b50e docs(spec): two-key privilege separation design ...

Enforce the agent/admin trust boundary with two env keys (EMCLI_ADMIN_KEY,
EMCLI_KEY) via envelope encryption: one DEK wrapped per role. Admin commands
unwrap the admin slot only (no agent fallback), so a forced agent holding
EMCLI_KEY cannot authorize config changes.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-06-22 22:34:26 +01:00

..

2026-06-22-two-key-privilege-design.md

docs(spec): two-key privilege separation design

2026-06-22 22:34:26 +01:00