Secretless Credential Setup Guide

Owner handoff for out-of-band credential configuration. No secret collection in ZAGOS.

LIVE ACTION BLOCKEDPARKED GATESECRETLESS GUIDE ONLYNOT LIVE ACTIVATEDNO SECRET COLLECTIONNO CREDENTIAL VALIDATIONNO OAUTH EXECUTIONNO PROVIDER CALLOWNER ACTION REQUIRED

What the owner configures outside ZAGOS

Register Enterprise Application in Entra ID
Grant requested read-only API scopes
Perform Admin Consent flow
Generate Client Secret securely
Store Client ID, Tenant ID, and Secret in isolated external secure storage

What ZAGOS must never collect

tenant_id
client_id
client_secret
certificates
refresh_token
access_token
auth_headers
cookies
env_values
workspace_id
user_id

Secret handling prohibited list

Any detection of actual values from the prohibited list in this repository must trigger an immediate rollback.

Allowed placeholders/status flags only

Placeholders (e.g., '********')
Status flags (e.g., 'CONFIG_REFERENCE_PENDING')
Storage paths (e.g., 'process.env.M365_CLIENT_ID')

Credential boundary contract

No secret values are present in this repository or UI.
No fields exist for manual credential entry.
ZAGOS delegates execution context to runtime environment variables only.
Runtime credentials are never printed, logged, or returned in payloads.

Owner handoff todos

Register app in Entra ID
Add exact read-only API permissions
Grant Tenant Admin Consent
Generate Client Secret
Inject credentials into Vercel ENV

Readiness checklist

Current Status: OWNER_CONFIG_REQUIRED

Owner must perform manual setup in Entra ID.

No credential validation in this phase

ZAGOS does not and cannot validate these credentials. The system will blindly attempt to use environment variables during the future first live-read execution rehearsal.

Navigation

→ Back to Live-Read Canary Approval Pack → Back to Live-Read Canary Control Room → Back to Live-Read Preactivation Readiness → Back to Final Acceptance Readiness