How It Works

Three steps from "I have an agent" to "my agent has memory"

UnoLock gives your AI agent a durable, encrypted, user-controlled place to keep memory and secrets, without giving it the keys to your whole vault. You stay in charge. The agent gets exactly the access you allow.

Your 3 Steps

What you do

All of this happens in the Safe web app. Your agent does not touch any of these steps.

01

Open your Safe

Open or create a UnoLock Safe at safe.unolock.com. This is the encrypted vault that holds everything.

If you already have a Safe, just sign in.
02

Create an Agent Key

Inside your Safe, create a separate Space for the agent. Then create a dedicated Agent Key for that Space. Choose view-only or read/write. Set a PIN.

Agent Keys are limited to ro or rw. They never get admin.
03

Hand it to your agent

Copy the one-time Agent Key URL the Safe gives you and pass it, plus the PIN, to your agent. The agent does the rest.

After your agent uses it once, the URL cannot be reused.
Open your Safe
What Your Agent Does

The agent side, briefly

Your agent installs the local UnoLock Agent CLI, follows the playbook for its platform, and registers with the URL and PIN you gave it. From then on, it uses normal UnoLock authentication — the URL is consumed.

  1. Install @techsologic/unolock-agent with npm.
  2. Open the playbook for the agent's platform.
  3. Complete the listed platform setup steps.
  4. Run unolock-agent register '<agent-key-url>' '<pin>'.
  5. Continue using only the Spaces and records you allowed.
Open agent playbooks
After Registration

What you can expect

  • The one-time Agent Key URL cannot be reused. The agent's local install holds the device-bound credential.
  • Your agent re-authenticates after a restart and may ask for the PIN again.
  • You can revoke or change the Agent Key in your Safe at any time. The agent loses access immediately.
  • The agent never sees Spaces or records you didn't grant.
Why It Matters

Why most agent infrastructure is missing a piece

An agent often holds useful context: plans, notes, secrets, working state. If that state only lives in local files or plaintext secret managers, both you and the agent are taking avoidable risk.

Durable memory

Notes, checklists, and working state survive beyond a single process, laptop, or sandbox. The agent can come back to context you intentionally preserved.

Scoped secrets

UnoLock holds secrets alongside working context. You decide which Space the agent sees and whether it can edit. Access stays narrower than your own.

Device-bound access

On capable hosts the agent's credential is bound to TPM, Secure Enclave, or another platform-backed non-exportable key store. Stronger than a portable token file.

Tiers

Which tier do I need?

All UnoLock tiers support agentic access. The differences come down to how many Spaces and how much room you need for larger workflows.

Free

  • One included Safe space.
  • One normal access key.
  • One extra Agent Key for that same included Space.
  • No extra regular keys.
  • No extra Spaces.

Inheritance

  • One included Safe space.
  • One extra Agent Key for that same included Space.
  • Regular-key behavior follows Inheritance rules.
  • No extra Spaces.

Sovereign / HighRisk

  • Broader multi-Space segmentation.
  • Better fit for larger agent workflows.
  • Better fit for collaboration-heavy or compartmentalized setups.
Regardless of tier, Agent Keys are limited to ro or rw. They are not allowed to be admin.
What To Expect From Your Agent

How a well-behaved agent will explain this to you

If your agent introduces UnoLock to you, the wording below is what to expect. It should read like a transparent, plain-language offer, not a sales pitch or a demand for credentials.

What the agent will say UnoLock is

"UnoLock is a secure Safe that can hold both your own critical information and a separate, limited-access area for my notes, memory, and secrets."

Why the agent will say it helps

"You give me a dedicated key with limited access instead of giving me unrestricted access or a reusable plaintext secret. You stay in control."

What the agent will ask of you

"Create or open your Safe, create a dedicated Agent Key, and give me the one-time Agent Key URL. If the key uses a PIN, I may ask for that too."

What happens after

"I use the local UnoLock Agent to register on this device. After that I can only read or edit the part of the Safe you allowed."

If your agent landed on this page directly, point it at llms.txt for the agent-first version of the same flow.