For teams

Secretariat in a team

Every developer keeps their own keys in their own keychain, and their agents stay blind to them. When a key has to go to a colleague, it travels as a sealed file only that colleague can open. No server, no shared vault to break into.

Applies to Secretariat 1.16.

How sharing works

1. Exchange codes once. Under Library → Team, each person copies their share code and sends it to colleagues by mail or chat. The colleague adds it under Team → Add Member. Compare the fingerprint once by phone or in person; the code itself is public.
2. Share. Select an item, choose Item → Share Item …, pick colleagues and items, confirm with Touch ID, save the file. Send the .secretariat-share file any way you like.
3. Open. The colleague double-clicks the file (or File → Open Share …). Secretariat shows who sent it, which items it holds and which already exist; existing items are never overwritten. New items carry “Shared by …” as their source.

Sharing, adding members and opening packages happen only in the app. No command-line call and no agent can share or import; the CLI shows only secretariat team code and secretariat team list.

When someone leaves

Remove them under Team. Secretariat lists every item you shared with them; “Mark for Rotation” marks those items “Rotate”, in the app, in secretariat status and in items --json. The mark disappears as soon as you save a new value. After rotating, secretariat targets shows every copy (Cloudflare, Supabase, GitHub, servers) that still has the old value. The item detail also says when a value changed after you shared it, so you know who has an outdated copy.

Rolling out with MDM

The app

Secretariat is a notarized Developer ID app. Your MDM deploys the installer package Secretariat-latest.pkg: signed with Developer ID Installer and notarized by Apple; it puts the app into /Applications and runs no scripts. Each user then links the command-line tool once: ln -s /Applications/Secretariat.app/Contents/MacOS/Secretariat ~/bin/secretariat.

Team members for everyone

Push a configuration profile with the payload com.apple.ManagedClient.preferences for the domain dev.moinsen.secretariat.local and the key TeamMembers: an array of share codes. Those members appear on every Mac as “Managed by your organization” and can't be removed in the app. Secretariat reads only values the profile enforces; a value someone sets with defaults write is ignored. We have tested the reading with Secretariat's test settings, not yet with a real MDM: tell us how it works with yours.

<key>TeamMembers</key>
<array>
  <string>stc1:…code of the team lead…</string>
  <string>stc1:…code of the build machine owner…</string>
</array>

Never put keys into a configuration profile. Profiles are readable on the Mac; keys belong in each person's keychain.

Licenses

A license is personal and covers all Macs of that person. For five or more licenses, write to [email protected].

Limits

• No shared live vault: a shared key is a copy. Changing it means sharing it again.
• No central audit log: each Mac keeps its own history of access.
• No single sign-on, SCIM or roles. If you need those, keep shared secrets in 1Password or Bitwarden and use Secretariat for each developer's own keys and the agent guardrails.
• Your own templates don't travel; a shared item of an unknown kind shows the generic template.
• macOS only.

Details on what each layer protects: threat model.