An instruction asking an AI agent to keep a token private isn't an isolation boundary. I wanted the agent to request a named action while the owner keeps the credential and approves each execution.
Separate the request from the credential.
Web Crypto API supplies rejection-sampled randomness for browser-generated credentials. Node.js runs the AES-256-GCM Envelope v2 scrypt vault and owner action broker outside the browser generator.
The broker requires a separate standard OS account and private owner installation. The public website never connects to it. Browser generation stays local, and copy history remains in memory unless you opt into unencrypted persistence.
Same-user processes do not provide isolation. Administrator access or shared screen automation is outside this model. Revoking a grant locally does not revoke a provider token remotely.
Giving an autonomous coding agent a raw GitHub, Cloudflare, or npm token in a .env file means one bad prompt can publish or delete production work.
Prompt instructions telling an AI to 'be careful with secrets' are not a security boundary. I needed the agent to ask for permission without ever seeing the key.
SafeGen separates the request from the credential: your agent requests a named action, and you approve the exact command in a private owner session.
Generate strong passwords and passphrases right in your browser, or run the local encrypted vault and action broker when your AI agents need to ship.