GET /api/secrets/policy
Machine-readable policy for authenticated targets and credentials agents must not send.
Secret storage policy
Public Action402 does not store long-lived target secrets.
The buyer path is accountless, so secret storage would need ownership checks, encryption lifecycle, rotation, and abuse controls before activation.
Safe alternatives
Keep authority near the target owner.
Use target-owned webhook URLs, short-lived per-request headers, or a dedicated allowlisted deployment when authenticated target calls need stronger controls.
POST /api/policy/check
Validate target safety before paying, without storing secrets or executing a target.