Getting started
The order to do things in, from an empty account to an agent working in tokens.
This page is the path from nothing to a working setup: an agent doing real work with your data, while the values it never needs to see are substituted at the last moment on a machine you control. Each step names the command to run and links to its reference page for the detail.
You will need an operator token for your vault, from whoever runs your Custodian server.
1. Sign in
Sign this machine in to the vault with your operator token.
2. Enrol this machine
Set the vault up from this first machine: generate its master key, enrol this machine as its first device, and record the recovery code. Write the recovery code down when it is shown — it is shown once.
3. Describe what you store
Write your schema — the collections, their fields, and each field's sensitivity — as one file, preview it, and apply it.
4. Load your records
Add records one at a time, or load a spreadsheet of them in one run. Every field marked
client_encrypted is sealed on your machine before it is sent.
→ custodian records · custodian records import
5. Create the agent's identity
Create a principal for the agent, and capture its token — it is printed once.
6. Grant it exactly what it needs
Give the agent access to the fields it needs, and no more. Granting it token access to a sensitive field lets it work with a stand-in for the value, never the value itself.
7. Run the agent in tokens
The agent produces a document with tokens where the real values belong. Turn those tokens back into values at the last moment — printed to a machine you control, or piped straight into a program without ever being shown.
→ custodian resolve · custodian exec
Along the way
- Add more machines that can read the vault, or retire one:
custodian device. - Keep a bounded working session open so repeated commands need not re-authenticate:
custodian unlock. - Review who was enrolled and who approved them:
custodian audit list.