Secrets vault
Store credentials the AI needs (a deploy token, a database password) encrypted, and attach them to a chat when needed.
One way in
Values are encrypted at rest and never returned to the browser after saving.
Saving
Reading it back
Encrypted at rest
Stored, encrypted.
Not returned to the browser.
Using one marks the chat
A chat that has used vault credentials is marked, and from that point it asks for zero-retention routing.