Bitwarden's Agent Access SDK integrates with OneCLI, allowing credentials to remain in the vault while OneCLI proxies API calls and enforces policies. Agents do not have visibility of the keys.