Every NanoClaw agent will access external services through OneCLI's Agent Vault, a gateway that handles credential injection, access policies, and approvals so agents never hold raw API keys.