Move one sensitive field behind the vault.

1. Choose a bounded workflow

Pick one field and one consumer. Email, phone, PAN, support transcript identifiers, or a RAG context path are good evaluation candidates. Define who may reveal it, for what purpose, and for how long.

2. Configure your endpoint

export SECURELAY_URL="https://vault.example.com"
export SECURELAY_TOKEN="<administrator-or-service-token>"

3. Seal the data

curl -sS "$SECURELAY_URL/v1/data" \
  -H "Authorization: Bearer $SECURELAY_TOKEN" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: customer-9842" \
  --data '{
    "vault_id": "customer-data",
    "records": [{"email": "[email protected]"}]
  }'

The response contains a safe reference. Store that reference in the application record instead of the email address.

4. Request a governed reveal

Call the reveal operation with the subject, purpose, and token required by your configured policy. Securelay evaluates the current grant and consent state. Your application must handle denial as a normal result.

5. Verify the evidence

Use Audit in the console to find the correlated action. Export a signed evidence bundle and run the repository verifier in an environment separate from the service.