Status
Accepted. Decided during WARDEN-WP-0026 (credential disclosure hygiene), in response to a real disclosure on 2026-07-16.
Context
On 2026-07-16 a secret value reached a captured stdout. The mechanism was ordinary: bao kv get -field=X in an agent session. Nothing was misconfigured and nobody misused a tool. The value was read correctly, by an authorized caller, using the documented command — and an agent session records its stdout, so the value landed in a transcript that outlives the shell.
This is a structural mismatch, not a mistake to train away. Agent sessions are logged by design; that is what makes them reviewable. A human at a terminal sees a value and it scrolls away. An agent "seeing" a value writes it into a durable context that may be stored, replayed, or sent to an inference provider.
Guidance alone will not fix it. The command is correct, it is in every runbook, and the next agent that needs the value will reach for it.
Decision
When WARDEN_AGENT_ID is set and the catalog lane is risk: high, ops-warden refuses to stream the raw value and exits 7. The agent is not blocked from doing its work — --out, --exec, --wrap and --fingerprint all remain available. It is blocked from doing its work in a way that writes the secret into a transcript.
The boundary is enforced at the credential store as well as at the CLI. The OpenBao policy agent-high-risk-boundary denies data-read on those paths for agent tokens, allowing metadata and capabilities only. A control that lives solely in our own CLI is a control that ends the moment someone calls bao directly.
Verification must not require a read. To check a lane, use bao token capabilities — allow/deny — never a read of the value. This is the specific habit the disclosure taught us to break.
Exposure is reportable without reading. warden taint <catalog-id> reports KV v2 custom_metadata (exposed_at, exposed_version) and touches no secret data.
Consequences
Agents can still do everything they could before, by a different route. --exec covers nearly every real case: the child process gets the value in its environment, the agent never sees it. The friction is deliberate and small.
Exit 7 is a contract other runtimes depend on. It is a distinguishable code, not a generic failure, so a caller can tell "refused by boundary" from "lane broken" and retry correctly. Changing it is a breaking change to every agent runtime.
risk: high becomes a load-bearing catalog field rather than documentation. Classifying a lane now changes runtime behaviour, so it must be set deliberately.
We accept that --unsafe-stdout still exists for humans. The boundary keys on WARDEN_AGENT_ID, so an agent that does not set it is not caught. That is a known limit: this ADR raises the floor for cooperating runtimes and hardens the store behind them; it does not claim to stop a determined caller.