Security: How Figaro Handles Keys, Agents, and Autonomy
Agents are born without credentials, keys live in an encrypted vault the agent never sees, every consequential action waits at one human gate — and autonomy is earned per seat, not granted by default.
Published August 9, 2026
Most agent products answer the security question with a paragraph. We think it deserves the architecture. Figaro was built inside a real company, running real ad spend and real books — so the safety model is not a policy document; it is the shape of the system.
Agents are born without credentials
Your API keys — Shopify, ad platforms, accounting — live in an encrypted vault, scoped to one brand, encrypted with AES-256-GCM. Agents never receive them. When a seat needs to call a service, the request goes through Figaro, which attaches the key server-side and forwards the call. Agent processes start with a scrubbed environment: an explicit allowlist of variables that never includes secrets. The practical consequence: there is nothing in an agent’s world worth stealing.
External AIs get hashes, not keys
When you connect your own AI (or your agency’s) to Figaro, it authenticates with a bearer token we store only as a SHA-256 hash. The plaintext is shown once, at mint, and never persisted. Revocation is a timestamp, not a delete — so old work still shows who did it, and “when did we cut this off” is always answerable.
One gate, held by a human
Every consequential action — money, published claims, anything irreversible — arrives as a card at a single approval gate that only a signed-in human can exercise. Rank does not imply approval power. Agent tokens cannot approve. Chat cannot approve. The strongest output any connected intelligence can produce is a proposal waiting for a person.
Autonomy is a ladder, not a default
We are not autonomy skeptics — we are sequence sticklers. Each seat sits on a rung: observe, draft, act-with-approval, autonomous-within-policy. Promotion is earned with measured results, and the top rung is bounded by explicit policy: spend caps, reversibility, scope. Yes — your ad manager can rebalance budget while you sleep. The difference is that when it does, it is exercising a permission you granted after watching it be right, inside limits you set, with every move landing in the ledger — and you can demote it in one click.
Sunlight is the enforcement that scales
Everything above produces a record: who proposed, who decided, what executed, what it cost, and whether it worked. The record is append-only — corrections are new rows, never edits. An agent (or an agency) that does sloppy work is visible doing it. That, more than any contract clause, is what keeps a fleet honest.
Questions founders ask
- Do Figaro agents hold my API keys?
- No. Keys live in an encrypted vault (AES-256-GCM), scoped to one brand, and are attached to requests server-side. The agent process is started with a scrubbed environment — an allowlist of variables that never includes credentials — so a compromised or confused agent has nothing to leak. When an external AI connects to Figaro, it authenticates with a bearer token we store only as a hash: a dump of our database cannot impersonate anyone.
- Can an AI approve its own actions?
- No, structurally. There is exactly one approval gate, and only a signed-in human can exercise it. Agent-held tokens can read and propose — the strongest thing any agent, chat, or connected AI can do is put a card in front of a person. There is no code path where software approves spend, publishes claims, or moves money on its own say-so.
- So my agents can never act while I sleep?
- They can — once they've earned it. Autonomy in Figaro is a ladder, set per seat: observe, draft, act-with-approval, and autonomous-within-policy at the top. A seat is promoted on measured results, not vibes, and the top rung is bounded by explicit policy — spend caps, reversibility, scope — with every action still landing in the ledger. The difference from tools that start autonomous: your ad manager moving budget overnight is a permission you granted with receipts in hand, revocable in one click, never a default you discovered later.
- Can one brand’s agent see another brand’s data?
- No. Every table, credential, document, and memory is scoped to a brand, and credentials never inherit across brands: a brand with no key of its own gets a named refusal, not a fallback to someone else’s key. This matters most for agencies — one operator can run many brands with hard walls between every client.
- How do I audit what an agent actually did?
- Every proposed action records who or what drafted it and which human decided it. Approved actions carry their external references — the actual campaign, listing, or order they touched. The business record itself is append-only: corrections are new rows, so history cannot be silently rewritten. The audit trail is not a feature bolted on for compliance; it is the substrate the whole product runs on.