One File for Everyone, or One Identity per Agent Diagram

Before: one file

Every agent reads the same values, whether the task needs them or not
When a value leaks, it names the account, not the agent that used it
Nothing in the file says which agent was allowed to reach what

With Keyspout: ask, prove, receive

The agent asks for one named secret and signs the request with the key you enrolled
Keyspout checks that signature against the identity it holds, and refuses if it does not match
What comes back is one version of that secret, bounded by a lease: a time-to-live or a count of uses
The lease is recorded, so you can answer which agent received which version, and when it expires

What you can answer afterwards

Which agent asked, proven by a key you enrolled
Which record and which version it received
Whether the stored copy still exists, and when it expires