Feature Request - Restricting CLI access to specific vaults

Hello all,

We’d like to use the 1Password CLI more widely on our developers’ laptops, to stop storing secrets in plain text in .env files. Instead, the file holds a secret reference (op://…) that is resolved at runtime.

The strong blocker we have today is that CLI access is all or nothing.

Once a user turns on the CLI integration, it can read every vault they have access to. For technical users with sensitive access, this includes vaults that should never be reachable locally, such as emergency vaults with break-glass production credentials.

Service accounts can be limited to specific vaults, but they don’t fit this case: their token has to be stored on the laptop, they don’t use Touch ID approval, and actions aren’t attributed to the individual developer.

Is there a plan to let users or admins restrict which vaults the CLI can access? And in the meantime, is there a recommended approach for this use case?