# IAM-02 Credential vault management (Critical)

Domain: IAM Identity, Access & Authorization · HI-AAF v1.3 · Public review · https://humanintel.net/standard/iam/iam-02

Agent credentials are stored in a managed secrets vault. Credentials are never embedded in prompts, source code, configuration files, or logs.

All agent credentials, API keys, tokens, certificates, are stored in a managed secrets vault with access logging and rotation support. Credentials are never embedded in prompts, source code, configuration files, or logs. This control prevents the most common credential-exposure vectors in agent deployments and ensures that credential lifecycle is managed centrally.

Critical control: a Critical failure precludes HI-AAF Certification regardless of the maturity level achieved on any other control.

## Maturity

- L1 Ad hoc: Controls exist informally; documentation is incomplete; no consistent review.
- L2 Documented: Controls are written down; ownership is assigned; review cadence is defined.
- L3 Operated: Controls are followed in practice; evidence is collected; deviations are tracked. Published criterion for IAM-02: All agent credentials are stored in a managed vault; no credentials appear in source code, configuration, prompts, or logs; vault access logs are reviewed at a documented cadence.
- L4 Measured: Control effectiveness is measured against documented thresholds; trends are reported.
- L5 Continuously Improved: Controls evolve based on incident learning; maturity gains are evidenced over time.

## Evidence an assessor asks for

- All agent credentials are stored in a managed vault.
- No credentials appear in source code, configuration, prompts, or logs.
- Vault access logs are reviewed at a documented cadence.

## Framework mappings

- ISO/IEC 42001: A.7.4
- SOC 2 (TSC): CC6.1
- EU AI Act: Art. 15(2)
- Singapore: PDPA s.24, AI Verify Security

Mappings are directional: meeting this control evidences but does not by itself satisfy the external requirement.

## Cite this control

Human Intelligence. HI-AAF v1.3, IAM-02 Credential vault management. Public review edition, July 2026. https://humanintel.net/standard/iam/iam-02