Two distinct sharing patterns:
  • Wrapping — hand a single secret to another caller once, with tamper evidence.
  • Cross-workspace grants — expose specific paths to another workspace inside the same organisation.

​
Wrapping

Producer wraps a secret into a one-time-use token: 
WRAP=$(tt secrets read -wrap-ttl=60s secret/prod/api-key -format=json | jq -r .wrap_info.token)
Send WRAP over the least-trusted channel available — Slack, email, a git commit message. Consumer unwraps once: 
tt secrets unwrap "$WRAP"
If the token was already unwrapped, the second unwrap fails and you know the channel was compromised. Inspect a wrap without consuming it: 
tt secrets wrapping lookup "$WRAP"
# → { creation_time, creation_path, creation_ttl }

​
Cross-workspace grants

An organisation admin can expose specific paths from one workspace to another (useful for a shared-services team publishing to product teams): 
tt secrets grants create \
  --from=wsp_platform \
  --to=wsp_payments \
  --path='secret/data/shared/certs/*' \
  --capabilities=read,list \
  --ttl=30d
The consumer workspace sees a virtual mount at the same path with the granted capabilities. Grants are audited on both sides.

Secrets

Reading, writing, and versioning.

Policies

Which policies apply to granted paths.