Use cases

Each guide states when to use it, the commands to type, and what to expect. Want good defaults without reading them? See the Policy quick start.

#	Guide	Goal
UC1	Gate your GitHub token from an AI agent	First install, enroll, harden gh
UC2	Approve or deny a secret read mid-session	The main story: save a secret, the agent tries to read it, you get the card
UC3	Let the agent read GitHub, gate writes and token export	Agent Read auto-allows, write and secret-reveal need a click
UC4	Trust your terminal fully, not the agent	Terminal Full, harness Read or Deny
UC5	One-shot secret for a script	save, inject, delete
UC6	Gate git, az, and docker	Harden the other tools, strong mode
UC7	Audit and scan when something feels wrong	doctor, whoami, scan, audit
UC8	Undo or uninstall	Unenroll, uninstall
UC9	Add and remove secrets in CmdWarden Vault	No CLI, desktop app only
UC10	Gate npm and your npm token	Publish and token commands ask; install scripts never see the token
UC11	Gate the AWS CLI	Key-printing and delete commands ask; keys in the vault
UC12	Gate kubectl	Secret objects, raw kubeconfig, exec, and deletes ask
UC13	Gate ssh key use	A push over ssh from the agent asks; your terminal pushes freely
UC14	Short-lived GitHub tokens for one repo	gh gets a GitHub App token for the current repo that ends in one hour
UC15	Keep API keys out of the agent	The agent sends cw://NAME; the proxy puts the real key in place for listed hosts only
UC16	Keep .env secrets out of the agent	cw env import moves the values; cw inject --env-file or --template gives them only to your program
UC17	Let an agent sign in without the password	The agent types cw://NAME in a sign-in form; you approve, and only the site gets the password
UC18	Sign git commits with a gated ssh key	Your terminal signs commits freely; an agent gets the card before it signs in your name

New here? Run cw setup, then read UC2. Terms you meet along the way are in the Glossary.