Tasmanian Cloud documentation

Kleis expressions

Encrypted secret references and scoped machine actions

Kleis is the secret and capability layer for workflows that must use sensitive values without copying them through every system involved in the work. Dialkeys provide the service identity and discovery side of that boundary.

Kleis encrypted secret reference flowTasmanian Cloud kleis encrypted secret reference flow.[KLEIS]SECRET REFno plaintextPOLICYscoped accessWORKLOADdecryptsKeep the boundary explicit. Let each system do the work it is good at.

Keep plaintext out of the workflow

Kleis stores values as encrypted material and exposes references and expressions to the systems that need to coordinate them. A template, webhook, log line, or AI context can carry the reference without carrying the plaintext value.

flowchart LR
    REF[Encrypted reference]
    POLICY[Scope and policy]
    MACHINE[Authorised machine]
    RESULT[Operation result]

    REF --> POLICY --> MACHINE --> RESULT

The authorised workload is the place where decryption or use occurs. The control plane can validate the reference and the policy without becoming a general-purpose vault that every operator, worker, or model can read.

Machine-to-machine work

A machine can request a scoped operation without receiving a permanent shared credential. The request can be bound to an environment, workload, action, or time window. This supports service-to-service workflows while keeping the permission close to the operation.

AI-assisted work

An AI workflow can request an action or a capability without putting the secret into the model context. The model can see the task, the permitted interface, and the result. It does not need to see the credential used by the machine that performs the task.

This reduces the chance that a secret is copied into a prompt, a transcript, a tool argument, or a generated configuration file.

Dialkeys instead of .env sprawl

A dialkey gives a service or deployment a logical identity. It can be used to publish or resolve a service and to derive purpose-specific configuration. The customer does not need to hand-maintain a separate .env value for every internal service relationship.

Dialkeys locate services and carry service identity. They do not decide tenant ownership or grant access. Kleis expressions and the access-control layer decide whether a caller can use the resolved service or value.

Zero-knowledge style use

Where a workflow uses Kleis encrypted references, the storage and coordination layers can carry ciphertext and references without holding a general-purpose plaintext copy. An authorised machine performs the decrypt or use operation at the point of need.

This is the useful boundary for machine-to-machine and AI-assisted work: the workflow can request an operation without placing the underlying key in a model context window.

Use Kleis with Saga

Saga templates can refer to Kleis expressions for database credentials, provider tokens, webhook signing keys, mail credentials, and other sensitive inputs. The template describes what the workload needs. The policy decides whether the workload can use it.

Related