Secret audit & metrics
In a Zero Trust model, every secret access must be attributable to an identity and a purpose. Alquimia Platform emits telemetry that lets you compare secret-fetch rates against actual task volume, so you can spot credential harvesting, misconfiguration, or confused-deputy attacks.
Why monitor secret access
Section titled “Why monitor secret access”The runtime resolves many secrets during inference: API keys, database credentials, signing keys, and channel tokens. If a role fetches secrets without a matching task volume, or if a master instance fetches secrets during inference, something is wrong.
Key signals
Section titled “Key signals”| Signal | What it tells you |
|---|---|
| Secret resolution rate | How often each role, agent, and runtime mode resolves secrets. |
| Task volume | How many inference tasks are started per agent and agentspace. |
| Fetch outcome | Whether fetches succeeded, failed because the secret was missing, or errored. |
| Source of fetch | Whether the fetch happened during registry inspection or agent execution. |
Common anomalies
Section titled “Common anomalies”| Pattern | Possible cause |
|---|---|
| Secret fetch rate spikes without task-volume growth | A tool or loop is resolving secrets repeatedly, or credentials are being harvested. |
| Idle role fetching secrets | A compromised or misconfigured workload is accessing credentials. |
| Inference-mode fetches on a master | The master deployment is incorrectly running worker logic. |
| High missing-secret rate | A secret was not registered or a reference name is wrong. |
Investigating an anomaly
Section titled “Investigating an anomaly”- Identify the role, agent, and source labels from the alert.
- Compare secret-fetch metrics with task-start metrics for the same scope.
- Inspect the worklog for the affected sessions to see what the agent was doing.
- Check Kafka topic ACLs and event signatures to rule out unauthorized producers.
- Verify the runtime mode and deployment topology of the affected pods.
Response actions
Section titled “Response actions”- Rotate credentials for the affected role or agentspace.
- Narrow Vault policies to limit unnecessary access.
- Fix misconfigurations that cause repeated secret fetches.
- Separate master and worker deployments if they are mixed.
- Add or tune alerts based on your baseline traffic patterns.