Same name. Different job.
HashiCorp Vault is the standard for secrets storage. STACK Vault is the identity, policy, and audit layer for AI agents and non-human identities. They are complementary, not redundant — here is the honest breakdown.
What each one is built for
STACK Vault
The trust layer for AI agents. Issues verifiable identities, scopes capabilities, enforces policy at runtime, signs every decision into an audit stream. Built for the agent era.
HashiCorp Vault
The standard secrets manager. Stores and rotates static secrets, manages PKI, brokers cloud credentials. Mature, broadly deployed, indispensable for human and service workflows.
Together
HashiCorp Vault holds the secret; STACK Vault decides which agent can ask for it, under what policy, and signs the request into a single audit trail. Most teams run both.
Where each one wins
Agent identity issuance
STACK Vault. Verifiable, scoped identities for AI agents and non-human callers; HashiCorp Vault stores secrets but does not issue agent identities.
Static secret storage
HashiCorp Vault. Battle-tested KV, PKI, and dynamic-credential engines; STACK Vault integrates with it rather than replacing it.
Runtime policy on agent actions
STACK Vault. Capability boundaries, tool-call audit, and per-action policy enforcement for agents and orchestrators.
Audit evidence for AI compliance
STACK Vault + Compli. Signed evidence mapped to NIST AI RMF, ISO 42001, EU AI Act, and SOC 2 — sourced from real Vault telemetry, not exported screenshots.
Common questions
Do we have to choose?
No. Most teams run HashiCorp Vault for secrets and STACK Vault for agent identity + policy. The two integrate at the credential-broker layer.
Why not just use HashiCorp Vault for agents?
You can store an agent's secrets in it. You still need an identity, policy, and audit layer specifically built for agent behavior — loop detection, tool-call boundaries, drift. That's what STACK Vault provides.
Where do we start?
If you already run HashiCorp Vault, leave it. Deploy STACK Vault next to it and point your agent runtime at STACK Vault for identity. Secrets still come from HashiCorp.
What if we don't run HashiCorp Vault?
Fine — STACK Vault works with cloud-native KMS and secret managers (AWS Secrets Manager, GCP Secret Manager, Azure Key Vault) too.