glas-harness/docs/anthropic-workload-key.md

Anthropic workload key

User selected a dedicated Anthropic API key on 2026-09-05 for GLAS-WP-0012-T02 / SAND-WP-0015-T04. Credential custody request: CCR-2026-0016. The request is in flight, not an active credential route. Offline validation passes and apply-plan refuses the incomplete request.

Concrete proposal

Setting	Proposed value
Anthropic organization	Awaiting user selection
Dedicated workspace	glas-harness
Workspace spend limit	Awaiting user selection
Service account / key label	glas-agent-dev
Key scope	Only the dedicated workspace
Initial expiry	30 days, subject to organization policy
KV-v2 entry	platform/workloads/glas-harness/claude-agent-dev
Only secret field	ANTHROPIC_API_KEY
Read policy name	workload-kv-read-glas-claude-agent-dev
Proposed route	glas-claude-agent-dev-anthropic
Consumer	Sand-boxer owner delivery to the selected Claude workload

These are proposed coordinates, not evidence that provider/OpenBao objects exist. The generic openbao-api-key routing entry is not a usable grant. No provider key or live auth role was created in this preparation.

Provider creation and custody

In the chosen organization's Console, create the dedicated workspace and set the approved spend limit. Have its administrator create the service account, add it to that workspace, and create a key linked to that account and scoped to the workspace. Record only organization/workspace/account/key identifiers, expiration and budget as evidence. Anthropic documents service account keys for automated workloads and creation in Settings → API keys: https://platform.claude.com/docs/en/manage-claude/authentication Workspace administration and limits: https://platform.claude.com/docs/en/manage-claude/workspaces

Complete the protected OpenBao custody writer before revealing a new key in the Console. Enter its value only through an attended hidden prompt or an approved private value file consumed by that writer. Never paste it into chat, put it in shell arguments, or store it in this repository. Initial storage must use KV-v2 CAS zero; rotations must use the reviewed current version. Existing platform tooling supports attended custody, but the exact writer and sandbox owner auth binding for this new entry still need implementation and verification. Do not substitute an ambient human token for machine identity.

The final read policy grants only the exact data entry, without metadata, listing, sibling access or writes. Verify negative access for generic coding agents. Sand-boxer must resolve the approved route and deliver the key to the workload without returning it or an OpenBao token to Glas. Environment delivery is visible to the trusted workload and its descendants; it does not hide the key from hostile code inside that workload.

Acceptance and rotation

Before activation, verify exact owner identity, read scope, protected delivery, redacted failures, source/artifact cleanliness and private-state teardown. Provider egress and the pinned Claude executable remain SAND-WP-0015 gates. Then run the bounded real proof specified in local-profile-acceptance.md. Keep the existing Glas profile blocked until these checks pass.

For rotation, create and store a replacement with CAS, stop runs carrying the predecessor, verify the replacement, revoke the predecessor at Anthropic and prove denial. OpenBao lease expiry alone does not revoke an Anthropic API key. For compromise, disable the provider key immediately and stop affected runs.