diff --git a/CHANGELOG.md b/CHANGELOG.md
index a64b90b..8c05716 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -14,18 +14,31 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Added
 
-- **Secret Sharing Foundation (Phase 3)** (#182)
-  - New `secret_shares` table for fine-grained access control
-  - XOR constraint enforces sharing with either user OR role (not both)
-  - Permission hierarchy: `admin` > `write` > `read`
-  - Optional expiration support via `expires_at` timestamp
-  - `SecretShare` model with UUID primary key, relationships, and scopes
-  - `Secret.shares()` relationship for access control queries
-  - `Secret.userHasPermission()` method validates user permissions (owner OR share)
-  - `active()` scope filters non-expired shares
-  - Migration tests verify schema integrity (3 tests)
-  - Model tests cover relationships, scopes, and expiration logic (10 tests)
-  - Foundation for upcoming Controllers and Policies in separate PR
+- **Secret Sharing & Access Control (Phase 3)** (#182)
+  - **Secret CRUD API**: Full REST API for password manager functionality
+    - Create secrets with encrypted title, username, password, URL, notes (POST `/v1/secrets`)
+    - List user's secrets with pagination (GET `/v1/secrets`)
+    - View secret details (GET `/v1/secrets/{secret}`)
+    - Update secrets with automatic version incrementing (PATCH `/v1/secrets/{secret}`)
+    - Soft delete secrets (DELETE `/v1/secrets/{secret}`)
+    - Owner-based authorization via `SecretPolicy`
+    - Validation via `StoreSecretRequest` and `UpdateSecretRequest`
+    - 17 comprehensive Controller tests
+  - **Secret Sharing API**: Grant/revoke access to secrets
+    - Grant read/write/admin access to users OR roles (POST `/v1/secrets/{secret}/shares`)
+    - List all shares for a secret (GET `/v1/secrets/{secret}/shares`)
+    - Revoke share access (DELETE `/v1/secrets/{secret}/shares/{share}`)
+    - XOR constraint validation: cannot grant to both user AND role
+    - Optional expiration dates for time-limited access
+    - Permission hierarchy: admin > write > read
+    - Authorization via `SecretSharePolicy` (owner-only for now)
+    - 18 comprehensive Controller tests covering all scenarios
+  - **Database Foundation** (already merged):
+    - `secret_shares` table with XOR constraint
+    - `SecretShare` model with relationships and scopes
+    - Migration tests and model tests (13 total)
+  - **Total Test Coverage**: 35 Controller tests, 13 Model tests, all passing
+  - **Note**: Tenant resolution uses temporary `TenantKey::first()` pattern (TODO: TenantMiddleware)
 
 - **File Attachments API (Phase 2)** (#175)
   - Upload encrypted file attachments to secrets (POST `/v1/secrets/{secret}/attachments`)
diff --git a/app/Http/Controllers/Api/V1/SecretController.php b/app/Http/Controllers/Api/V1/SecretController.php
new file mode 100644
index 0000000..4c5cf70
--- /dev/null
+++ b/app/Http/Controllers/Api/V1/SecretController.php
@@ -0,0 +1,213 @@
+<?php
+
+// SPDX-FileCopyrightText: 2025 SecPal Contributors
+//
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+namespace App\Http\Controllers\Api\V1;
+
+use App\Http\Controllers\Controller;
+use App\Http\Requests\StoreSecretRequest;
+use App\Http\Requests\UpdateSecretRequest;
+use App\Models\Secret;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+use Illuminate\Http\Response;
+
+/**
+ * SecretController handles CRUD operations for Secrets.
+ *
+ * All secrets are scoped to the authenticated user's tenant.
+ * Users can access secrets they own (owner-based) only.
+ * Shared secret access via SecretShare is checked at Policy level.
+ */
+class SecretController extends Controller
+{
+    /**
+     * Transform Secret model to API response format with plaintext fields.
+     *
+     * @return array<string, mixed>
+     */
+    private function transformSecret(Secret $secret): array
+    {
+        return [
+            'id' => $secret->id,
+            'title' => $secret->title_plain,
+            'username' => $secret->username_plain,
+            'password' => $secret->password_plain,
+            'url' => $secret->url_plain,
+            'notes' => $secret->notes_plain,
+            'tags' => $secret->tags,
+            'expires_at' => $secret->expires_at?->toIso8601String(),
+            'version' => $secret->version,
+            'created_at' => $secret->created_at->toIso8601String(),
+            'updated_at' => $secret->updated_at->toIso8601String(),
+        ];
+    }
+
+    /**
+     * Assign request fields to secret model.
+     *
+     * @return bool Whether any field was modified
+     */
+    private function assignFields(Secret $secret, Request $request): bool
+    {
+        $modified = false;
+
+        if ($request->has('title')) {
+            /** @var string $value */
+            $value = $request->input('title');
+            $secret->title_plain = $value;
+            $modified = true;
+        }
+        if ($request->has('username')) {
+            /** @var string|null $value */
+            $value = $request->input('username');
+            $secret->username_plain = $value;
+            $modified = true;
+        }
+        if ($request->has('password')) {
+            /** @var string|null $value */
+            $value = $request->input('password');
+            $secret->password_plain = $value;
+            $modified = true;
+        }
+        if ($request->has('url')) {
+            /** @var string|null $value */
+            $value = $request->input('url');
+            $secret->url_plain = $value;
+            $modified = true;
+        }
+        if ($request->has('notes')) {
+            /** @var string|null $value */
+            $value = $request->input('notes');
+            $secret->notes_plain = $value;
+            $modified = true;
+        }
+        if ($request->has('tags')) {
+            /** @var array<string>|null $value */
+            $value = $request->input('tags');
+            $secret->tags = $value;
+            $modified = true;
+        }
+        if ($request->has('expires_at')) {
+            /** @var \Illuminate\Support\Carbon|null $value */
+            $value = $request->input('expires_at');
+            $secret->expires_at = $value;
+            $modified = true;
+        }
+
+        return $modified;
+    }
+
+    /**
+     * Display a listing of secrets accessible to the authenticated user.
+     */
+    public function index(Request $request): JsonResponse
+    {
+        $this->authorize('viewAny', Secret::class);
+
+        /** @var \App\Models\User $user */
+        $user = $request->user();
+
+        // Query secrets owned by user
+        $query = Secret::where('owner_id', $user->id);
+
+        // Pagination
+        /** @var int $perPageInput */
+        $perPageInput = $request->input('per_page', 15);
+        $perPage = min((int) $perPageInput, 100);
+        $secrets = $query->paginate($perPage);
+
+        // Transform secrets to include plaintext fields
+        $transformedSecrets = $secrets->getCollection()->map(fn (Secret $secret) => $this->transformSecret($secret));
+
+        return response()->json([
+            'data' => $transformedSecrets,
+            'meta' => [
+                'current_page' => $secrets->currentPage(),
+                'per_page' => $secrets->perPage(),
+                'total' => $secrets->total(),
+            ],
+        ]);
+    }
+
+    /**
+     * Store a newly created secret.
+     */
+    public function store(StoreSecretRequest $request): JsonResponse
+    {
+        $this->authorize('create', Secret::class);
+
+        /** @var \App\Models\User $user */
+        $user = $request->user();
+
+        // TODO: Replace with TenantMiddleware that injects tenant_id into request
+        // For now, use first available tenant (testing only - NOT production-ready)
+        $tenantId = \App\Models\TenantKey::first()?->id;
+        if (! $tenantId) {
+            return response()->json([
+                'error' => 'Tenant resolution not yet implemented. Please contact system administrator.',
+            ], Response::HTTP_SERVICE_UNAVAILABLE);
+        }
+
+        $secret = new Secret;
+        $secret->tenant_id = $tenantId;
+        $secret->owner_id = $user->id;
+        $secret->version = 1;
+
+        $this->assignFields($secret, $request);
+        $secret->save();
+
+        return response()->json([
+            'data' => $this->transformSecret($secret),
+        ], Response::HTTP_CREATED);
+    }
+
+    /**
+     * Display the specified secret.
+     */
+    public function show(Secret $secret): JsonResponse
+    {
+        // Authorization handled by SecretPolicy
+        $this->authorize('view', $secret);
+
+        return response()->json([
+            'data' => $this->transformSecret($secret),
+        ]);
+    }
+
+    /**
+     * Update the specified secret.
+     */
+    public function update(UpdateSecretRequest $request, Secret $secret): JsonResponse
+    {
+        // Authorization handled by SecretPolicy
+        $this->authorize('update', $secret);
+
+        $modified = $this->assignFields($secret, $request);
+
+        if ($modified) {
+            // Increment version on update
+            $secret->version++;
+            $secret->save();
+        }
+
+        return response()->json([
+            'data' => $this->transformSecret($secret),
+        ]);
+    }
+
+    /**
+     * Remove the specified secret (soft delete).
+     */
+    public function destroy(Secret $secret): Response
+    {
+        // Authorization handled by SecretPolicy
+        $this->authorize('delete', $secret);
+
+        $secret->delete();
+
+        return response()->noContent();
+    }
+}
diff --git a/app/Http/Controllers/Api/V1/SecretShareController.php b/app/Http/Controllers/Api/V1/SecretShareController.php
new file mode 100644
index 0000000..4fb5438
--- /dev/null
+++ b/app/Http/Controllers/Api/V1/SecretShareController.php
@@ -0,0 +1,106 @@
+<?php
+
+// SPDX-FileCopyrightText: 2025 SecPal Contributors
+//
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+namespace App\Http\Controllers\Api\V1;
+
+use App\Http\Controllers\Controller;
+use App\Http\Requests\GrantShareRequest;
+use App\Models\Secret;
+use App\Models\SecretShare;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Response;
+
+/**
+ * SecretShareController handles sharing secrets with users and roles.
+ *
+ * Implements access control via SecretShare model:
+ * - Grant read/write/admin to users OR roles (XOR)
+ * - Optional expiration dates
+ * - Only secret owner can grant/revoke
+ */
+class SecretShareController extends Controller
+{
+    /**
+     * List all shares for a secret.
+     */
+    public function index(Secret $secret): JsonResponse
+    {
+        // Authorization
+        $this->authorize('viewAny', [SecretShare::class, $secret]);
+
+        // Query active (non-expired) shares
+        $shares = SecretShare::where('secret_id', $secret->id)
+            ->active()
+            ->get();
+
+        // Transform to API response
+        $data = $shares->map(fn (SecretShare $share) => $this->transformShare($share));
+
+        return response()->json([
+            'data' => $data,
+        ]);
+    }
+
+    /**
+     * Grant access to a secret.
+     */
+    public function store(GrantShareRequest $request, Secret $secret): JsonResponse
+    {
+        // Authorization
+        $this->authorize('create', [SecretShare::class, $secret]);
+
+        /** @var \App\Models\User $user */
+        $user = $request->user();
+
+        // Create share
+        $share = SecretShare::create([
+            'secret_id' => $secret->id,
+            'user_id' => $request->input('user_id'),
+            'role_id' => $request->input('role_id'),
+            'permission' => $request->input('permission'),
+            'granted_by' => $user->id,
+            'granted_at' => now(),
+            'expires_at' => $request->input('expires_at'),
+        ]);
+
+        return response()->json([
+            'data' => $this->transformShare($share),
+        ], Response::HTTP_CREATED);
+    }
+
+    /**
+     * Revoke a share.
+     */
+    public function destroy(Secret $secret, SecretShare $share): Response
+    {
+        // Authorization
+        $this->authorize('delete', [SecretShare::class, $secret, $share]);
+
+        // Delete share
+        $share->delete();
+
+        return response()->noContent();
+    }
+
+    /**
+     * Transform SecretShare to API response format.
+     *
+     * @return array<string, mixed>
+     */
+    private function transformShare(SecretShare $share): array
+    {
+        return [
+            'id' => $share->id,
+            'secret_id' => $share->secret_id,
+            'user_id' => $share->user_id,
+            'role_id' => $share->role_id,
+            'permission' => $share->permission,
+            'granted_by' => $share->granted_by,
+            'granted_at' => $share->granted_at->toIso8601String(),
+            'expires_at' => $share->expires_at?->toIso8601String(),
+        ];
+    }
+}
diff --git a/app/Http/Controllers/Controller.php b/app/Http/Controllers/Controller.php
index 02fa486..d3c18ed 100644
--- a/app/Http/Controllers/Controller.php
+++ b/app/Http/Controllers/Controller.php
@@ -5,7 +5,9 @@
 
 namespace App\Http\Controllers;
 
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
+
 abstract class Controller
 {
-    //
+    use AuthorizesRequests;
 }
diff --git a/app/Http/Requests/GrantShareRequest.php b/app/Http/Requests/GrantShareRequest.php
new file mode 100644
index 0000000..7b3cd4f
--- /dev/null
+++ b/app/Http/Requests/GrantShareRequest.php
@@ -0,0 +1,92 @@
+<?php
+
+// SPDX-FileCopyrightText: 2025 SecPal Contributors
+//
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+namespace App\Http\Requests;
+
+use Illuminate\Foundation\Http\FormRequest;
+use Illuminate\Validation\Rule;
+
+/**
+ * Request validation for granting secret access.
+ *
+ * Enforces XOR constraint: EITHER user_id OR role_id must be present, not both.
+ */
+class GrantShareRequest extends FormRequest
+{
+    /**
+     * Determine if the user is authorized to make this request.
+     */
+    public function authorize(): bool
+    {
+        // Authorization is handled by SecretSharePolicy
+        return true;
+    }
+
+    /**
+     * Get the validation rules that apply to the request.
+     *
+     * @return array<string, \Illuminate\Contracts\Validation\ValidationRule|array<mixed>|string>
+     */
+    public function rules(): array
+    {
+        return [
+            'user_id' => [
+                'required_without:role_id',
+                'nullable',
+                'string',
+                'uuid',
+                'exists:users,id',
+            ],
+            'role_id' => [
+                'required_without:user_id',
+                'nullable',
+                'integer',
+                'exists:roles,id',
+            ],
+            'permission' => [
+                'required',
+                'string',
+                Rule::in(['read', 'write', 'admin']),
+            ],
+            'expires_at' => [
+                'nullable',
+                'date',
+                'after:now',
+            ],
+        ];
+    }
+
+    /**
+     * Configure the validator instance.
+     *
+     * @param  \Illuminate\Validation\Validator  $validator
+     */
+    public function withValidator($validator): void
+    {
+        $validator->after(function (\Illuminate\Validation\Validator $validator): void {
+            // XOR constraint: user_id and role_id cannot both be present
+            if ($this->filled('user_id') && $this->filled('role_id')) {
+                $validator->errors()->add('user_id', 'Cannot grant to both user and role simultaneously (XOR constraint).');
+                $validator->errors()->add('role_id', 'Cannot grant to both user and role simultaneously (XOR constraint).');
+            }
+        });
+    }
+
+    /**
+     * Get custom validation messages.
+     *
+     * @return array<string, string>
+     */
+    public function messages(): array
+    {
+        return [
+            'user_id.required_without' => 'Either user_id or role_id must be provided.',
+            'role_id.required_without' => 'Either user_id or role_id must be provided.',
+            'permission.in' => 'Permission must be one of: read, write, admin.',
+            'expires_at.after' => 'Expiration date must be in the future.',
+        ];
+    }
+}
diff --git a/app/Http/Requests/StoreSecretRequest.php b/app/Http/Requests/StoreSecretRequest.php
new file mode 100644
index 0000000..f41a20e
--- /dev/null
+++ b/app/Http/Requests/StoreSecretRequest.php
@@ -0,0 +1,57 @@
+<?php
+
+// SPDX-FileCopyrightText: 2025 SecPal Contributors
+//
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+namespace App\Http\Requests;
+
+use Illuminate\Foundation\Http\FormRequest;
+
+/**
+ * Validation rules for creating a new Secret.
+ */
+class StoreSecretRequest extends FormRequest
+{
+    /**
+     * Determine if the user is authorized to make this request.
+     */
+    public function authorize(): bool
+    {
+        return true; // Authorization handled by controller/policy
+    }
+
+    /**
+     * Get the validation rules that apply to the request.
+     *
+     * @return array<string, array<int, string>>
+     */
+    public function rules(): array
+    {
+        return [
+            'title' => ['required', 'string', 'max:255'],
+            'username' => ['nullable', 'string', 'max:255'],
+            'password' => ['nullable', 'string', 'max:1000'],
+            'url' => ['nullable', 'string', 'url', 'max:2048'],
+            'notes' => ['nullable', 'string', 'max:10000'],
+            'tags' => ['nullable', 'array'],
+            'tags.*' => ['string', 'max:50'],
+            'expires_at' => ['nullable', 'date', 'after:now'],
+        ];
+    }
+
+    /**
+     * Get custom error messages for validator errors.
+     *
+     * @return array<string, string>
+     */
+    public function messages(): array
+    {
+        return [
+            'title.required' => 'A title is required for the secret.',
+            'title.string' => 'The title must be a valid string.',
+            'expires_at.after' => 'The expiration date must be in the future.',
+            'tags.*.string' => 'Each tag must be a valid string.',
+        ];
+    }
+}
diff --git a/app/Http/Requests/UpdateSecretRequest.php b/app/Http/Requests/UpdateSecretRequest.php
new file mode 100644
index 0000000..5a0898f
--- /dev/null
+++ b/app/Http/Requests/UpdateSecretRequest.php
@@ -0,0 +1,56 @@
+<?php
+
+// SPDX-FileCopyrightText: 2025 SecPal Contributors
+//
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+namespace App\Http\Requests;
+
+use Illuminate\Foundation\Http\FormRequest;
+
+/**
+ * Validation rules for updating an existing Secret.
+ */
+class UpdateSecretRequest extends FormRequest
+{
+    /**
+     * Determine if the user is authorized to make this request.
+     */
+    public function authorize(): bool
+    {
+        return true; // Authorization handled by controller/policy
+    }
+
+    /**
+     * Get the validation rules that apply to the request.
+     *
+     * @return array<string, array<int, string>>
+     */
+    public function rules(): array
+    {
+        return [
+            'title' => ['sometimes', 'string', 'max:255'],
+            'username' => ['nullable', 'string', 'max:255'],
+            'password' => ['nullable', 'string', 'max:1000'],
+            'url' => ['nullable', 'string', 'url', 'max:2048'],
+            'notes' => ['nullable', 'string', 'max:10000'],
+            'tags' => ['nullable', 'array'],
+            'tags.*' => ['string', 'max:50'],
+            'expires_at' => ['nullable', 'date', 'after:now'],
+        ];
+    }
+
+    /**
+     * Get custom error messages for validator errors.
+     *
+     * @return array<string, string>
+     */
+    public function messages(): array
+    {
+        return [
+            'title.string' => 'The title must be a valid string.',
+            'expires_at.after' => 'The expiration date must be in the future.',
+            'tags.*.string' => 'Each tag must be a valid string.',
+        ];
+    }
+}
diff --git a/app/Policies/SecretPolicy.php b/app/Policies/SecretPolicy.php
new file mode 100644
index 0000000..aab7ad4
--- /dev/null
+++ b/app/Policies/SecretPolicy.php
@@ -0,0 +1,77 @@
+<?php
+
+// SPDX-FileCopyrightText: 2025 SecPal Contributors
+//
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+namespace App\Policies;
+
+use App\Models\Secret;
+use App\Models\User;
+
+/**
+ * Authorization policy for Secret model.
+ *
+ * Controls access to secrets based on ownership and share permissions.
+ */
+class SecretPolicy
+{
+    /**
+     * Determine whether the user can view any secrets.
+     */
+    public function viewAny(User $user): bool
+    {
+        return true; // All authenticated users can list their secrets
+    }
+
+    /**
+     * Determine whether the user can view the secret.
+     */
+    public function view(User $user, Secret $secret): bool
+    {
+        // Check via userHasPermission (handles owner + share access)
+        return $secret->userHasPermission($user, 'read');
+    }
+
+    /**
+     * Determine whether the user can create secrets.
+     */
+    public function create(User $user): bool
+    {
+        return true; // All authenticated users can create secrets
+    }
+
+    /**
+     * Determine whether the user can update the secret.
+     */
+    public function update(User $user, Secret $secret): bool
+    {
+        // Check via userHasPermission (handles owner + share access)
+        return $secret->userHasPermission($user, 'write');
+    }
+
+    /**
+     * Determine whether the user can delete the secret.
+     */
+    public function delete(User $user, Secret $secret): bool
+    {
+        // Check via userHasPermission (handles owner + share access)
+        return $secret->userHasPermission($user, 'admin');
+    }
+
+    /**
+     * Determine whether the user can restore the secret.
+     */
+    public function restore(User $user, Secret $secret): bool
+    {
+        return $secret->owner_id === $user->id;
+    }
+
+    /**
+     * Determine whether the user can permanently delete the secret.
+     */
+    public function forceDelete(User $user, Secret $secret): bool
+    {
+        return $secret->owner_id === $user->id;
+    }
+}
diff --git a/app/Policies/SecretSharePolicy.php b/app/Policies/SecretSharePolicy.php
new file mode 100644
index 0000000..27dc8b4
--- /dev/null
+++ b/app/Policies/SecretSharePolicy.php
@@ -0,0 +1,56 @@
+<?php
+
+// SPDX-FileCopyrightText: 2025 SecPal Contributors
+//
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+namespace App\Policies;
+
+use App\Models\Secret;
+use App\Models\SecretShare;
+use App\Models\User;
+
+/**
+ * Policy for SecretShare access control.
+ *
+ * Authorization Rules:
+ * - Only secret owner can grant/revoke shares
+ * - Only secret owner can list shares
+ * - Future: Users with 'admin' permission on secret can also grant/revoke
+ */
+class SecretSharePolicy
+{
+    /**
+     * Determine if user can view all shares for a secret.
+     */
+    public function viewAny(User $user, Secret $secret): bool
+    {
+        // Only owner can list shares
+        return $secret->owner_id === $user->id;
+    }
+
+    /**
+     * Determine if user can grant access to a secret.
+     */
+    public function create(User $user, Secret $secret): bool
+    {
+        // Only owner can grant access
+        // TODO: Allow users with 'admin' permission on secret
+        return $secret->owner_id === $user->id;
+    }
+
+    /**
+     * Determine if user can revoke a share.
+     */
+    public function delete(User $user, Secret $secret, SecretShare $share): bool
+    {
+        // Only owner can revoke shares
+        // TODO: Allow users with 'admin' permission on secret
+        // Verify share belongs to this secret
+        if ($share->secret_id !== $secret->id) {
+            return false;
+        }
+
+        return $secret->owner_id === $user->id;
+    }
+}
diff --git a/app/Providers/AppServiceProvider.php b/app/Providers/AppServiceProvider.php
index c917f78..131c132 100644
--- a/app/Providers/AppServiceProvider.php
+++ b/app/Providers/AppServiceProvider.php
@@ -9,11 +9,14 @@
 use App\Models\Person;
 use App\Models\Secret;
 use App\Models\SecretAttachment;
+use App\Models\SecretShare;
 use App\Observers\PersonObserver;
 use App\Observers\SecretObserver;
 use App\Policies\PermissionManagementPolicy;
 use App\Policies\RoleManagementPolicy;
 use App\Policies\SecretAttachmentPolicy;
+use App\Policies\SecretPolicy;
+use App\Policies\SecretSharePolicy;
 use Illuminate\Support\Facades\Gate;
 use Illuminate\Support\ServiceProvider;
 use Spatie\Permission\Models\Role;
@@ -42,6 +45,12 @@ public function boot(): void
         // Register policy for Spatie Permission model
         Gate::policy(Permission::class, PermissionManagementPolicy::class);
 
+        // Register policy for Secret model
+        Gate::policy(Secret::class, SecretPolicy::class);
+
+        // Register policy for SecretShare model
+        Gate::policy(SecretShare::class, SecretSharePolicy::class);
+
         // Register policy for SecretAttachment model
         Gate::policy(SecretAttachment::class, SecretAttachmentPolicy::class);
 
diff --git a/routes/api.php b/routes/api.php
index a5c1004..f76c4ca 100644
--- a/routes/api.php
+++ b/routes/api.php
@@ -6,6 +6,8 @@
 use App\Http\Controllers\Api\V1\PermissionManagementController;
 use App\Http\Controllers\Api\V1\RoleManagementController;
 use App\Http\Controllers\Api\V1\SecretAttachmentController;
+use App\Http\Controllers\Api\V1\SecretController;
+use App\Http\Controllers\Api\V1\SecretShareController;
 use App\Http\Controllers\Api\V1\UserPermissionController;
 use App\Http\Controllers\AuthController;
 use App\Http\Controllers\PersonController;
@@ -107,5 +109,17 @@
         Route::get('/secrets/{secret}/attachments', [SecretAttachmentController::class, 'index']);
         Route::get('/attachments/{attachment}/download', [SecretAttachmentController::class, 'download']);
         Route::delete('/attachments/{attachment}', [SecretAttachmentController::class, 'destroy']);
+
+        // Secret Sharing endpoints (Phase 3) - must be before single {secret} routes
+        Route::get('/secrets/{secret}/shares', [SecretShareController::class, 'index']);
+        Route::post('/secrets/{secret}/shares', [SecretShareController::class, 'store']);
+        Route::delete('/secrets/{secret}/shares/{share}', [SecretShareController::class, 'destroy']);
+
+        // Secret CRUD endpoints (Phase 3)
+        Route::get('/secrets', [SecretController::class, 'index']);
+        Route::post('/secrets', [SecretController::class, 'store']);
+        Route::get('/secrets/{secret}', [SecretController::class, 'show']);
+        Route::patch('/secrets/{secret}', [SecretController::class, 'update']);
+        Route::delete('/secrets/{secret}', [SecretController::class, 'destroy']);
     });
 });
diff --git a/tests/Feature/Controllers/Api/V1/SecretControllerTest.php b/tests/Feature/Controllers/Api/V1/SecretControllerTest.php
new file mode 100644
index 0000000..cf773f1
--- /dev/null
+++ b/tests/Feature/Controllers/Api/V1/SecretControllerTest.php
@@ -0,0 +1,562 @@
+<?php
+
+// SPDX-FileCopyrightText: 2025 SecPal Contributors
+//
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+use App\Models\Secret;
+use App\Models\TenantKey;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Carbon;
+
+use function Pest\Laravel\actingAs;
+use function Pest\Laravel\deleteJson;
+use function Pest\Laravel\getJson;
+use function Pest\Laravel\patchJson;
+use function Pest\Laravel\postJson;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    // Use process-specific KEK file for parallel test isolation
+    TenantKey::setKekPath(getTestKekPath());
+    TenantKey::generateKek();
+
+    // Create tenant
+    $keys = TenantKey::generateEnvelopeKeys();
+    $this->tenant = TenantKey::create($keys);
+
+    // Create authenticated user
+    $this->user = User::factory()->create();
+    actingAs($this->user, 'sanctum');
+});
+
+afterEach(function () {
+    cleanupTestKekFile();
+    TenantKey::setKekPath(null);
+});
+
+describe('SecretController - List Secrets', function () {
+    test('user can list own secrets', function () {
+        // Arrange: Create secrets owned by user
+        $ownSecret1 = createTestSecret([
+            'tenant_id' => $this->tenant->id,
+            'owner_id' => $this->user->id,
+            'title_plain' => 'My Password',
+        ]);
+        $ownSecret2 = createTestSecret([
+            'tenant_id' => $this->tenant->id,
+            'owner_id' => $this->user->id,
+            'title_plain' => 'API Key',
+        ]);
+
+        // Create secret by other user (should not appear)
+        $otherUserKeys = TenantKey::generateEnvelopeKeys();
+        $otherTenant = TenantKey::create($otherUserKeys);
+        $otherUser = User::factory()->create();
+        createTestSecret([
+            'tenant_id' => $otherTenant->id,
+            'owner_id' => $otherUser->id,
+            'title_plain' => 'Other Secret',
+        ]);
+
+        // Act
+        $response = getJson('/v1/secrets');
+
+        // Assert
+        $response->assertOk()
+            ->assertJsonStructure([
+                'data' => [
+                    '*' => [
+                        'id',
+                        'title',
+                        'expires_at',
+                        'version',
+                        'created_at',
+                        'updated_at',
+                    ],
+                ],
+                'meta' => [
+                    'current_page',
+                    'per_page',
+                    'total',
+                ],
+            ])
+            ->assertJsonCount(2, 'data')
+            ->assertJsonPath('data.0.id', $ownSecret1->id)
+            ->assertJsonPath('data.1.id', $ownSecret2->id);
+    });
+
+    test('list secrets returns paginated results', function () {
+        // Arrange: Create 15 secrets
+        foreach (range(1, 15) as $i) {
+            createTestSecret([
+                'tenant_id' => $this->tenant->id,
+                'owner_id' => $this->user->id,
+                'title_plain' => "Secret {$i}",
+            ]);
+        }
+
+        // Act
+        $response = getJson('/v1/secrets?per_page=10');
+
+        // Assert
+        $response->assertOk()
+            ->assertJsonCount(10, 'data')
+            ->assertJsonPath('meta.total', 15)
+            ->assertJsonPath('meta.per_page', 10);
+    });
+});
+
+describe('SecretController - Create Secret', function () {
+    test('user can create secret with minimum fields', function () {
+        // Arrange
+        $data = [
+            'title' => 'My New Secret',
+        ];
+
+        // Act
+        $response = postJson('/v1/secrets', $data);
+
+        // Assert
+        $response->assertCreated()
+            ->assertJsonStructure([
+                'data' => [
+                    'id',
+                    'title',
+                    'version',
+                    'created_at',
+                ],
+            ]);
+
+        $secretId = $response->json('data.id');
+        $secret = Secret::find($secretId);
+
+        expect($secret)->not->toBeNull()
+            ->and($secret->owner_id)->toBe($this->user->id)
+            ->and($secret->tenant_id)->toBe($this->tenant->id)
+            ->and($secret->title_plain)->toBe('My New Secret')
+            ->and($secret->version)->toBe(1);
+    });
+
+    test('user can create secret with all fields', function () {
+        // Arrange
+        $data = [
+            'title' => 'Complete Secret',
+            'username' => 'john.doe',
+            'password' => 'super-secret-123',
+            'url' => 'https://secpal.app/login',
+            'notes' => 'Important credentials',
+            'tags' => ['work', 'production'],
+            'expires_at' => '2026-12-31',
+        ];
+
+        // Act
+        $response = postJson('/v1/secrets', $data);
+
+        // Assert
+        $response->assertCreated();
+
+        $secret = Secret::find($response->json('data.id'));
+        expect($secret->title_plain)->toBe('Complete Secret')
+            ->and($secret->username_plain)->toBe('john.doe')
+            ->and($secret->password_plain)->toBe('super-secret-123')
+            ->and($secret->url_plain)->toBe('https://secpal.app/login')
+            ->and($secret->notes_plain)->toBe('Important credentials')
+            ->and($secret->tags)->toBe(['work', 'production'])
+            ->and($secret->expires_at)->toBeInstanceOf(Carbon::class);
+    });
+
+    test('title is required when creating secret', function () {
+        // Arrange
+        $data = [
+            'username' => 'user',
+            // title missing
+        ];
+
+        // Act
+        $response = postJson('/v1/secrets', $data);
+
+        // Assert
+        $response->assertUnprocessable()
+            ->assertJsonValidationErrors(['title']);
+    });
+
+    test('title must be string', function () {
+        // Arrange
+        $data = ['title' => 123];
+
+        // Act
+        $response = postJson('/v1/secrets', $data);
+
+        // Assert
+        $response->assertUnprocessable()
+            ->assertJsonValidationErrors(['title']);
+    });
+
+    test('expires_at must be date in future', function () {
+        // Arrange
+        $data = [
+            'title' => 'Test',
+            'expires_at' => '2020-01-01', // Past date
+        ];
+
+        // Act
+        $response = postJson('/v1/secrets', $data);
+
+        // Assert
+        $response->assertUnprocessable()
+            ->assertJsonValidationErrors(['expires_at']);
+    });
+
+    test('tags must be array of strings', function () {
+        // Arrange
+        $data = [
+            'title' => 'Test',
+            'tags' => [123, 456], // Invalid: numbers
+        ];
+
+        // Act
+        $response = postJson('/v1/secrets', $data);
+
+        // Assert
+        $response->assertUnprocessable()
+            ->assertJsonValidationErrors(['tags.0', 'tags.1']);
+    });
+});
+
+describe('SecretController - View Secret', function () {
+    test('user can view own secret', function () {
+        // Arrange
+        $secret = createTestSecret([
+            'tenant_id' => $this->tenant->id,
+            'owner_id' => $this->user->id,
+            'title_plain' => 'My Secret',
+            'username_plain' => 'admin',
+            'password_plain' => 'pass123',
+        ]);
+
+        // Act
+        $response = getJson("/v1/secrets/{$secret->id}");
+
+        // Assert
+        $response->assertOk()
+            ->assertJsonStructure([
+                'data' => [
+                    'id',
+                    'title',
+                    'username',
+                    'password',
+                    'url',
+                    'notes',
+                    'tags',
+                    'expires_at',
+                    'version',
+                    'created_at',
+                    'updated_at',
+                ],
+            ])
+            ->assertJsonPath('data.id', $secret->id)
+            ->assertJsonPath('data.title', 'My Secret')
+            ->assertJsonPath('data.username', 'admin')
+            ->assertJsonPath('data.password', 'pass123');
+    });
+
+    test('user cannot view others secret', function () {
+        // Arrange: Secret owned by different user
+        $otherUserKeys = TenantKey::generateEnvelopeKeys();
+        $otherTenant = TenantKey::create($otherUserKeys);
+        $otherUser = User::factory()->create();
+        $secret = createTestSecret([
+            'tenant_id' => $otherTenant->id,
+            'owner_id' => $otherUser->id,
+            'title_plain' => 'Private Secret',
+        ]);
+
+        // Act
+        $response = getJson("/v1/secrets/{$secret->id}");
+
+        // Assert
+        $response->assertForbidden();
+    });
+
+    test('viewing nonexistent secret returns 404', function () {
+        // Arrange: Create a secret to ensure route exists
+        $secret = createTestSecret([
+            'tenant_id' => $this->tenant->id,
+            'owner_id' => $this->user->id,
+            'title_plain' => 'Existing',
+        ]);
+
+        // Act: Try to view non-existent UUID
+        $response = getJson('/v1/secrets/00000000-0000-0000-0000-000000000000');
+
+        // Assert
+        $response->assertNotFound();
+    });
+});
+
+describe('SecretController - Update Secret', function () {
+    test('user can update own secret', function () {
+        // Arrange
+        $secret = createTestSecret([
+            'tenant_id' => $this->tenant->id,
+            'owner_id' => $this->user->id,
+            'title_plain' => 'Original Title',
+        ]);
+
+        $updateData = [
+            'title' => 'Updated Title',
+            'username' => 'new-user',
+        ];
+
+        // Act
+        $response = patchJson("/v1/secrets/{$secret->id}", $updateData);
+
+        // Assert
+        $response->assertOk()
+            ->assertJsonPath('data.title', 'Updated Title')
+            ->assertJsonPath('data.username', 'new-user')
+            ->assertJsonPath('data.version', 2); // Version incremented
+    });
+
+    test('updating secret increments version', function () {
+        // Arrange
+        $secret = createTestSecret([
+            'tenant_id' => $this->tenant->id,
+            'owner_id' => $this->user->id,
+            'title_plain' => 'Original',
+        ]);
+
+        expect($secret->version)->toBe(1);
+
+        // Act
+        $response = patchJson("/v1/secrets/{$secret->id}", [
+            'title' => 'Updated',
+        ]);
+
+        // Assert
+        $response->assertOk();
+        $secret->refresh();
+        expect($secret->version)->toBe(2);
+    });
+
+    test('user cannot update others secret', function () {
+        // Arrange
+        $otherUserKeys = TenantKey::generateEnvelopeKeys();
+        $otherTenant = TenantKey::create($otherUserKeys);
+        $otherUser = User::factory()->create();
+        $secret = createTestSecret([
+            'tenant_id' => $otherTenant->id,
+            'owner_id' => $otherUser->id,
+            'title_plain' => 'Private',
+        ]);
+
+        // Act
+        $response = patchJson("/v1/secrets/{$secret->id}", [
+            'title' => 'Hacked',
+        ]);
+
+        // Assert
+        $response->assertForbidden();
+    });
+});
+
+describe('SecretController - Delete Secret', function () {
+    test('user can delete own secret', function () {
+        // Arrange
+        $secret = createTestSecret([
+            'tenant_id' => $this->tenant->id,
+            'owner_id' => $this->user->id,
+            'title_plain' => 'To Delete',
+        ]);
+
+        // Act
+        $response = deleteJson("/v1/secrets/{$secret->id}");
+
+        // Assert
+        $response->assertNoContent();
+
+        // Verify soft delete
+        expect(Secret::find($secret->id))->toBeNull()
+            ->and(Secret::withTrashed()->find($secret->id))->not->toBeNull();
+    });
+
+    test('user cannot delete others secret', function () {
+        // Arrange
+        $otherUserKeys = TenantKey::generateEnvelopeKeys();
+        $otherTenant = TenantKey::create($otherUserKeys);
+        $otherUser = User::factory()->create();
+        $secret = createTestSecret([
+            'tenant_id' => $otherTenant->id,
+            'owner_id' => $otherUser->id,
+            'title_plain' => 'Protected',
+        ]);
+
+        // Act
+        $response = deleteJson("/v1/secrets/{$secret->id}");
+
+        // Assert
+        $response->assertForbidden();
+
+        // Verify not deleted
+        expect(Secret::find($secret->id))->not->toBeNull();
+    });
+});
+
+describe('SecretController - Share-Based Access', function () {
+    test('user with read share can view secret', function () {
+        // Arrange: Create secret owned by different user
+        $owner = User::factory()->create();
+        $secret = createTestSecret([
+            'tenant_id' => $this->tenant->id,
+            'owner_id' => $owner->id,
+            'title_plain' => 'Shared Secret',
+            'password_plain' => 'shared-pass',
+        ]);
+
+        // Grant read access to current user
+        \App\Models\SecretShare::create([
+            'secret_id' => $secret->id,
+            'user_id' => $this->user->id,
+            'permission' => 'read',
+            'granted_by' => $owner->id,
+            'granted_at' => now(),
+        ]);
+
+        // Act
+        $response = getJson("/v1/secrets/{$secret->id}");
+
+        // Assert
+        $response->assertOk()
+            ->assertJsonPath('data.title', 'Shared Secret')
+            ->assertJsonPath('data.password', 'shared-pass');
+    });
+
+    test('user with read share cannot update secret', function () {
+        // Arrange
+        $owner = User::factory()->create();
+        $secret = createTestSecret([
+            'tenant_id' => $this->tenant->id,
+            'owner_id' => $owner->id,
+            'title_plain' => 'Read Only',
+        ]);
+
+        \App\Models\SecretShare::create([
+            'secret_id' => $secret->id,
+            'user_id' => $this->user->id,
+            'permission' => 'read',
+            'granted_by' => $owner->id,
+            'granted_at' => now(),
+        ]);
+
+        // Act
+        $response = patchJson("/v1/secrets/{$secret->id}", [
+            'title' => 'Hacked',
+        ]);
+
+        // Assert
+        $response->assertForbidden();
+    });
+
+    test('user with write share can update secret', function () {
+        // Arrange
+        $owner = User::factory()->create();
+        $secret = createTestSecret([
+            'tenant_id' => $this->tenant->id,
+            'owner_id' => $owner->id,
+            'title_plain' => 'Editable',
+        ]);
+
+        \App\Models\SecretShare::create([
+            'secret_id' => $secret->id,
+            'user_id' => $this->user->id,
+            'permission' => 'write',
+            'granted_by' => $owner->id,
+            'granted_at' => now(),
+        ]);
+
+        // Act
+        $response = patchJson("/v1/secrets/{$secret->id}", [
+            'title' => 'Updated by Shared User',
+        ]);
+
+        // Assert
+        $response->assertOk()
+            ->assertJsonPath('data.title', 'Updated by Shared User');
+    });
+
+    test('user with write share cannot delete secret', function () {
+        // Arrange
+        $owner = User::factory()->create();
+        $secret = createTestSecret([
+            'tenant_id' => $this->tenant->id,
+            'owner_id' => $owner->id,
+            'title_plain' => 'Protected',
+        ]);
+
+        \App\Models\SecretShare::create([
+            'secret_id' => $secret->id,
+            'user_id' => $this->user->id,
+            'permission' => 'write',
+            'granted_by' => $owner->id,
+            'granted_at' => now(),
+        ]);
+
+        // Act
+        $response = deleteJson("/v1/secrets/{$secret->id}");
+
+        // Assert
+        $response->assertForbidden();
+    });
+
+    test('user with admin share can delete secret', function () {
+        // Arrange
+        $owner = User::factory()->create();
+        $secret = createTestSecret([
+            'tenant_id' => $this->tenant->id,
+            'owner_id' => $owner->id,
+            'title_plain' => 'Deletable',
+        ]);
+
+        \App\Models\SecretShare::create([
+            'secret_id' => $secret->id,
+            'user_id' => $this->user->id,
+            'permission' => 'admin',
+            'granted_by' => $owner->id,
+            'granted_at' => now(),
+        ]);
+
+        // Act
+        $response = deleteJson("/v1/secrets/{$secret->id}");
+
+        // Assert
+        $response->assertNoContent();
+    });
+
+    test('expired share does not grant access', function () {
+        // Arrange
+        $owner = User::factory()->create();
+        $secret = createTestSecret([
+            'tenant_id' => $this->tenant->id,
+            'owner_id' => $owner->id,
+            'title_plain' => 'Expired Access',
+        ]);
+
+        \App\Models\SecretShare::create([
+            'secret_id' => $secret->id,
+            'user_id' => $this->user->id,
+            'permission' => 'read',
+            'granted_by' => $owner->id,
+            'granted_at' => now()->subDays(10),
+            'expires_at' => now()->subDay(), // Expired yesterday
+        ]);
+
+        // Act
+        $response = getJson("/v1/secrets/{$secret->id}");
+
+        // Assert
+        $response->assertForbidden();
+    });
+});
diff --git a/tests/Feature/Controllers/Api/V1/SecretShareControllerTest.php b/tests/Feature/Controllers/Api/V1/SecretShareControllerTest.php
new file mode 100644
index 0000000..e22e03c
--- /dev/null
+++ b/tests/Feature/Controllers/Api/V1/SecretShareControllerTest.php
@@ -0,0 +1,364 @@
+<?php
+
+// SPDX-FileCopyrightText: 2025 SecPal Contributors
+//
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+use App\Models\Secret;
+use App\Models\SecretShare;
+use App\Models\TenantKey;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Spatie\Permission\Models\Role;
+
+use function Pest\Laravel\actingAs;
+use function Pest\Laravel\deleteJson;
+use function Pest\Laravel\getJson;
+use function Pest\Laravel\postJson;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    // Use process-specific KEK file for parallel test isolation
+    TenantKey::setKekPath(getTestKekPath());
+    TenantKey::generateKek();
+
+    // Create tenant
+    $keys = TenantKey::generateEnvelopeKeys();
+    $this->tenant = TenantKey::create($keys);
+
+    // Seed roles and permissions
+    $this->seed(\Database\Seeders\RolesAndPermissionsSeeder::class);
+
+    // Create owner user
+    $this->owner = User::factory()->create();
+    actingAs($this->owner, 'sanctum');
+
+    // Create a secret owned by owner
+    $this->secret = createTestSecret([
+        'tenant_id' => $this->tenant->id,
+        'owner_id' => $this->owner->id,
+        'title_plain' => 'Shared Secret',
+    ]);
+
+    // Create another user for sharing
+    $this->otherUser = User::factory()->create();
+});
+
+afterEach(function () {
+    cleanupTestKekFile();
+    TenantKey::setKekPath(null);
+});
+
+describe('SecretShareController - Grant Access', function () {
+    test('owner can grant read access to user', function () {
+        // Act
+        $response = postJson("/v1/secrets/{$this->secret->id}/shares", [
+            'user_id' => $this->otherUser->id,
+            'permission' => 'read',
+        ]);
+
+        // Assert
+        $response->assertCreated()
+            ->assertJsonStructure([
+                'data' => [
+                    'id',
+                    'secret_id',
+                    'user_id',
+                    'role_id',
+                    'permission',
+                    'granted_by',
+                    'granted_at',
+                    'expires_at',
+                ],
+            ])
+            ->assertJsonPath('data.user_id', $this->otherUser->id)
+            ->assertJsonPath('data.permission', 'read')
+            ->assertJsonPath('data.granted_by', $this->owner->id);
+
+        // Verify database
+        expect(SecretShare::count())->toBe(1);
+        $share = SecretShare::first();
+        expect($share->secret_id)->toBe($this->secret->id)
+            ->and($share->user_id)->toBe($this->otherUser->id)
+            ->and($share->permission)->toBe('read');
+    });
+
+    test('owner can grant write access to role', function () {
+        // Arrange
+        $role = Role::findByName('Manager', 'sanctum');
+
+        // Act
+        $response = postJson("/v1/secrets/{$this->secret->id}/shares", [
+            'role_id' => $role->id,
+            'permission' => 'write',
+        ]);
+
+        // Assert
+        $response->assertCreated()
+            ->assertJsonPath('data.role_id', $role->id)
+            ->assertJsonPath('data.permission', 'write')
+            ->assertJsonPath('data.user_id', null);
+
+        // Verify database
+        $share = SecretShare::first();
+        expect($share->role_id)->toBe($role->id)
+            ->and($share->user_id)->toBeNull();
+    });
+
+    test('owner can grant admin access', function () {
+        // Act
+        $response = postJson("/v1/secrets/{$this->secret->id}/shares", [
+            'user_id' => $this->otherUser->id,
+            'permission' => 'admin',
+        ]);
+
+        // Assert
+        $response->assertCreated()
+            ->assertJsonPath('data.permission', 'admin');
+    });
+
+    test('owner can grant with expiration date', function () {
+        // Arrange
+        $expiresAt = now()->addDays(7)->toIso8601String();
+
+        // Act
+        $response = postJson("/v1/secrets/{$this->secret->id}/shares", [
+            'user_id' => $this->otherUser->id,
+            'permission' => 'read',
+            'expires_at' => $expiresAt,
+        ]);
+
+        // Assert
+        $response->assertCreated()
+            ->assertJsonPath('data.expires_at', $expiresAt);
+    });
+
+    test('cannot grant with both user_id and role_id (XOR constraint)', function () {
+        // Arrange
+        $role = Role::findByName('Manager', 'sanctum');
+
+        // Act
+        $response = postJson("/v1/secrets/{$this->secret->id}/shares", [
+            'user_id' => $this->otherUser->id,
+            'role_id' => $role->id,
+            'permission' => 'read',
+        ]);
+
+        // Assert
+        $response->assertUnprocessable()
+            ->assertJsonValidationErrors(['user_id', 'role_id']);
+    });
+
+    test('cannot grant without user_id or role_id', function () {
+        // Act
+        $response = postJson("/v1/secrets/{$this->secret->id}/shares", [
+            'permission' => 'read',
+        ]);
+
+        // Assert
+        $response->assertUnprocessable()
+            ->assertJsonValidationErrors(['user_id']);
+    });
+
+    test('permission is required', function () {
+        // Act
+        $response = postJson("/v1/secrets/{$this->secret->id}/shares", [
+            'user_id' => $this->otherUser->id,
+        ]);
+
+        // Assert
+        $response->assertUnprocessable()
+            ->assertJsonValidationErrors(['permission']);
+    });
+
+    test('permission must be valid enum (read, write, admin)', function () {
+        // Act
+        $response = postJson("/v1/secrets/{$this->secret->id}/shares", [
+            'user_id' => $this->otherUser->id,
+            'permission' => 'invalid',
+        ]);
+
+        // Assert
+        $response->assertUnprocessable()
+            ->assertJsonValidationErrors(['permission']);
+    });
+
+    test('expires_at must be future date', function () {
+        // Act
+        $response = postJson("/v1/secrets/{$this->secret->id}/shares", [
+            'user_id' => $this->otherUser->id,
+            'permission' => 'read',
+            'expires_at' => now()->subDay()->toIso8601String(),
+        ]);
+
+        // Assert
+        $response->assertUnprocessable()
+            ->assertJsonValidationErrors(['expires_at']);
+    });
+
+    test('non-owner cannot grant access', function () {
+        // Arrange: Act as different user
+        actingAs($this->otherUser, 'sanctum');
+
+        // Act
+        $response = postJson("/v1/secrets/{$this->secret->id}/shares", [
+            'user_id' => User::factory()->create()->id,
+            'permission' => 'read',
+        ]);
+
+        // Assert
+        $response->assertForbidden();
+    });
+
+    test('cannot grant to non-existent user', function () {
+        // Act
+        $response = postJson("/v1/secrets/{$this->secret->id}/shares", [
+            'user_id' => '99999999-9999-9999-9999-999999999999',
+            'permission' => 'read',
+        ]);
+
+        // Assert
+        $response->assertUnprocessable()
+            ->assertJsonValidationErrors(['user_id']);
+    });
+
+    test('cannot grant to non-existent role', function () {
+        // Act
+        $response = postJson("/v1/secrets/{$this->secret->id}/shares", [
+            'role_id' => 99999,
+            'permission' => 'read',
+        ]);
+
+        // Assert
+        $response->assertUnprocessable()
+            ->assertJsonValidationErrors(['role_id']);
+    });
+});
+
+describe('SecretShareController - List Shares', function () {
+    test('owner can list all shares for secret', function () {
+        // Arrange: Create multiple shares
+        $role = Role::findByName('Manager', 'sanctum');
+        SecretShare::create([
+            'secret_id' => $this->secret->id,
+            'user_id' => $this->otherUser->id,
+            'permission' => 'read',
+            'granted_by' => $this->owner->id,
+            'granted_at' => now(),
+        ]);
+        SecretShare::create([
+            'secret_id' => $this->secret->id,
+            'role_id' => $role->id,
+            'permission' => 'write',
+            'granted_by' => $this->owner->id,
+            'granted_at' => now(),
+        ]);
+
+        // Act
+        $response = getJson("/v1/secrets/{$this->secret->id}/shares");
+
+        // Assert
+        $response->assertOk()
+            ->assertJsonCount(2, 'data')
+            ->assertJsonStructure([
+                'data' => [
+                    '*' => [
+                        'id',
+                        'secret_id',
+                        'user_id',
+                        'role_id',
+                        'permission',
+                        'granted_by',
+                        'granted_at',
+                        'expires_at',
+                    ],
+                ],
+            ]);
+    });
+
+    test('non-owner cannot list shares', function () {
+        // Arrange: Act as different user
+        actingAs($this->otherUser, 'sanctum');
+
+        // Act
+        $response = getJson("/v1/secrets/{$this->secret->id}/shares");
+
+        // Assert
+        $response->assertForbidden();
+    });
+
+    test('list shows only non-expired shares', function () {
+        // Arrange: Create expired and active shares
+        SecretShare::create([
+            'secret_id' => $this->secret->id,
+            'user_id' => $this->otherUser->id,
+            'permission' => 'read',
+            'granted_by' => $this->owner->id,
+            'granted_at' => now(),
+            'expires_at' => now()->subDay(), // Expired
+        ]);
+        SecretShare::create([
+            'secret_id' => $this->secret->id,
+            'user_id' => User::factory()->create()->id,
+            'permission' => 'read',
+            'granted_by' => $this->owner->id,
+            'granted_at' => now(),
+            'expires_at' => now()->addDay(), // Active
+        ]);
+
+        // Act
+        $response = getJson("/v1/secrets/{$this->secret->id}/shares");
+
+        // Assert
+        $response->assertOk()
+            ->assertJsonCount(1, 'data'); // Only active share
+    });
+});
+
+describe('SecretShareController - Revoke Access', function () {
+    test('owner can revoke share', function () {
+        // Arrange: Create share
+        $share = SecretShare::create([
+            'secret_id' => $this->secret->id,
+            'user_id' => $this->otherUser->id,
+            'permission' => 'read',
+            'granted_by' => $this->owner->id,
+            'granted_at' => now(),
+        ]);
+
+        // Act
+        $response = deleteJson("/v1/secrets/{$this->secret->id}/shares/{$share->id}");
+
+        // Assert
+        $response->assertNoContent();
+        expect(SecretShare::count())->toBe(0);
+    });
+
+    test('non-owner cannot revoke share', function () {
+        // Arrange: Create share, then act as different user
+        $share = SecretShare::create([
+            'secret_id' => $this->secret->id,
+            'user_id' => $this->otherUser->id,
+            'permission' => 'read',
+            'granted_by' => $this->owner->id,
+            'granted_at' => now(),
+        ]);
+        actingAs($this->otherUser, 'sanctum');
+
+        // Act
+        $response = deleteJson("/v1/secrets/{$this->secret->id}/shares/{$share->id}");
+
+        // Assert
+        $response->assertForbidden();
+        expect(SecretShare::count())->toBe(1); // Share still exists
+    });
+
+    test('revoking non-existent share returns 404', function () {
+        // Act
+        $response = deleteJson("/v1/secrets/{$this->secret->id}/shares/99999999-9999-9999-9999-999999999999");
+
+        // Assert
+        $response->assertNotFound();
+    });
+});
diff --git a/tests/Pest.php b/tests/Pest.php
index 72ffe19..24e73a8 100644
--- a/tests/Pest.php
+++ b/tests/Pest.php
@@ -108,6 +108,13 @@ function createTestSecret(array $attributes): \App\Models\Secret
     $secret->tenant_id = $attributes['tenant_id'];
     $secret->owner_id = $attributes['owner_id'];
     $secret->title_plain = $attributes['title_plain'] ?? 'Test Secret';
+    $secret->username_plain = $attributes['username_plain'] ?? null;
+    $secret->password_plain = $attributes['password_plain'] ?? null;
+    $secret->url_plain = $attributes['url_plain'] ?? null;
+    $secret->notes_plain = $attributes['notes_plain'] ?? null;
+    $secret->tags = $attributes['tags'] ?? null;
+    $secret->expires_at = $attributes['expires_at'] ?? null;
+    $secret->version = $attributes['version'] ?? 1;
     $secret->save();
 
     return $secret;