With the `secstore` on plan9, you lock files into a vault of sorts. It works in tandem with the `factotum` agent, which handles all authorization on behalf of the user, and secstore. You can't directly touch any files contained within*, but you can request a file, and push a file into the store. There is a lot of crossover, but the intriguing part comes from how they've separated the password management from the store, meaning that for a chicken and egg problem, you can create a password well before the store is ever created.

I use this for a few things, but mostly it works with the aforementioned factotum, which requests a list of all stored passwords from the secstore, so my session I rarely ever have to type in a password. And it's always, in every case, just my master password for factotum.