Credentials — keys your team and AI employees use

The Credentials tab on a user's page (Users → open a user) shows which third-party tools that person or AI employee is set up for — GitLab, AWS, and so on:

1. Add grant records that the user should have access to a tool (it starts as pending). Pick the tool from the list — it shows where to get the key and marks the tools an AI employee can use directly (MCP) — or type a name that isn't listed.
2. Set value (optional) stores the actual key encrypted in ALMAS's vault — the entry turns active and shows a lock with a version number. For an AI employee, its runner picks the key up automatically and starts using it.
3. Reveal shows a stored value — you must re-enter your password first, the value is shown once, and every reveal is recorded in the audit trail.
4. Rotate (Set value again) replaces the key and bumps the version — AI employees get the new key automatically.
5. Revoke removes the access record and deletes any stored key.

You'll only see this tab if your role has the manage credentials permission; revealing values additionally needs reveal credentials.