---
id: multi-user/pty-vault-and-opencode-receive-no-identity-at
title: "`pty`, `vault` and `opencode` receive no identity at all"
theme: multi-user
status: open
created: 2026-08-20
date_source: assumed
order: 15
---

**`pty`, `vault` and `opencode` receive no identity at all.** Every other sidecar validates
`X-Officer-User`. The pty sidecar keys purely on a `sessionId` from the query string and its
`/_officer/sessions` endpoints list and kill _every_ session on the box; vault and opencode take
no user argument. All three are covered today only because `terminal`, `vault` and the agent are
owner-only permissions — that is a correct outcome resting on the wrong layer, and it is the
thing to fix first if any of them is ever granted.