HashiCorp · IBM
Vault
Vault uses identity, policy and short-lived credentials to stop secrets from spreading and to leave an auditable access trail.
- Identity People, applications, agents and cloud accounts are identified first, without static passwords.
- Auth, policy and leases Vault issues short-lived credentials with least privilege that expire automatically.
- Targets Databases, cloud APIs and pipelines are accessed under leases.
- Audited end to end Issuance, rotation and access are all recorded.
Scenarios and capabilities
Fitting scenarios
- Passwords and API keys scattered across configs, images and scripts
- Permissions are too broad and hard to revoke in time
- CI/CD and AI agents need short-lived, auditable credentials
Key capabilities
- Identity for people, applications and workloads
- Policy control and dynamic secrets
- Automatic expiry and revocation on lease end
- Audit of issuance, rotation and access
How BSG delivers
BSG handles design and rollout: integration with DBScale and OpenShift, secrets migration and operating rules, and identity design for agent scenarios. The product comes from HashiCorp and is now part of IBM.
Layer Security control plane Issues short-lived credentials for data services and agents and audits access.
Related solutions and services
- Solution AI infrastructure solution Layers and responsibilities across products View
- Operations Open source operations Mostly remote; on-site support for major changes and incidents. View
- AI AI services Readiness review, scenario delivery, data infrastructure, secrets governance and platform care. View