[hiroTamada]

Summary

Documents the new vgs vault provider: card payments with cards that stay in a customer's own VGS vault.

• New guide integrations/wallets/bring-your-own-vgs-vault.mdx:
  • prerequisites on the VGS side (alias reveal enabled, an aliases:read-only service account, a fresh volatile CVC alias per purchase)
  • registering the provider configuration (vault_id, environment, the checks run on create, and that only client_secret can rotate)
  • creating the wallet (provider_config required, connected on creation)
  • creating and authorizing a card with the write-only spec.card, then filling
  • authorization failure outcomes (declined with invalid_card / alias_not_found / provider_credentials_rejected, and a retryable 503 provider_unavailable)
  • what Kernel stores, including that the card number alias is retained in Kernel's vault
• Wallets overview: adds the payment source row and the vgs notes on provider configurations, immutability, and card-only purchases.
• Payments lifecycle: one sentence on how vgs authorization works.
• Sidebar: adds the page after AgentCard.

TypeScript and Python examples only. The CLI doesn't support provider: vgs configurations or cards yet, and the page says so.

Before merging

• SDK release: the examples need @onkernel/sdk and kernel 0.141.0, which are still open release PRs (kernel-node-sdk#230, kernel-python-sdk#211). The page states 0.141.0 as the minimum.
• Production availability: the API enables vgs for every org once its outbound proxy config is set. Confirm that config and the Alias API route on the live vault are in place before this is published.
• environment: sandbox: the page lists sandbox because the API accepts it. Confirm a sandbox customer vault can be used against production before publishing, or drop it from the page.

Testing

• mint broken-links: no broken links.
• mint dev: the new page renders (HTTP 200, all sections present).
• Examples follow the merged API schemas; they were not run against production.

---

Note

Low Risk
Documentation-only changes with no runtime or security logic modified in this diff.

Overview
Adds documentation for paying with cards that stay in a customer-owned VGS vault via provider: "vgs", without copying PAN/CVC into KERNEL.

The new Bring Your Own VGS Vault guide covers VGS prerequisites (aliases:read, volatile CVC per purchase), org-scoped provider configuration (vault_id, environment, secret rotation rules), wallet and per-purchase card items with write-only spec.card, passwordless authorize, fill/checkout behavior, failure outcomes, and what KERNEL retains in its own VGS vault. It notes SDK 0.141.0+ and that the CLI does not support VGS yet.

Wallets overview and Payments lifecycle text are updated with a VGS payment-source row, provider-configuration immutability for VGS, and that VGS purchases use card items only. docs.json adds the page to the Payments sidebar after AgentCard.

^{Reviewed by Cursor Bugbot for commit dc7b684. Bugbot is set up for automated code reviews on this repo. Configure here.}

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated
Kernel	🟢 Ready	View Preview	Nov 5, 2026, 3:37 PM

💡 Tip: Enable Automations to automatically generate PRs for you.

[priscilla-kernel]

looks good, thank you!