# syntax=agentrc.agentfile/v0.1

# vault-agent — an agent that needs a credential it does NOT carry.
#
# Secrets are DEFERRED in this draft: the Agentfile defines no secret keyword and
# no credential schema. This agent talks to an internal database, but the way its
# database credential is resolved and injected is left entirely to the platform
# (a future secrets subsystem — Vault, a broker, env injection, or workload
# identity). The Agentfile only declares the egress it needs and the objective;
# the credential never appears here, in any layer, or in any label.

FROM python:3.11-slim

IDENTITY name=vault-agent version=1.0 author=acme
IDENTITY description="Reads from an internal database using a platform-injected credential (resolution deferred)"

CAPABILITY text

SOP You are a database read assistant. Query only what the user asks for; never echo credentials or connection strings.

CMD python -m vault_agent.main

# Local tool, embedded as a layer.
COPY --chmod=755 ./tools/db_query /mnt/tools/db_query

# Egress request: reach the database host on its port. The platform grants,
# narrows, or rejects this; deny-by-default means no other egress is honoured.
POLICY network dns:db.internal.example:5432

# How the database credential is provided to the agent is PLATFORM-DEFINED and
# out of scope for this draft — see the spec's "Secrets (deferred)" section.