Q:

How do Travel Sentry locks work? (supposedly openable only by security agencies)

Apparently Travel Sentry locks can only be opened:

by their owner,
by the TSA, CATSA and "other security agencies".

How do they work technically?
Is there some electronics embedded with authentication capabilities?
Do the security agencies have a kind of master code/key?
Do they have a big database giving the code for each individual lock? In that case I guess the lock has to emit some kind of identifier?
Apparently some have just a code, some other have just a key hole:
 
And some have both, see the pictures on Wikimedia Commons.

A:

They're all master keyed. On each lock you'll see a number ("TSA007" or such) that signifies which key on the ring the TSA agent needs to use to open the lock.
It's bad enough that anybody can buy a few of them and disassemble the locks to know exactly which keys to cut (as one could with any keyed-alike lock). The effort to open them is far lower than that, though: they're embarrassingly insecure locks on their own. You can watch somebody in this video pop open 3 locks in a row, each with seconds of effort using the same generic jiggler keys: https://www.youtube.com/watch?v=xtJx3j7AhQk

A:

The idea of the TSA padlocks is to be used on luggage and travel bags for international flights. They are not designed to be used for high security purposes, so they will be extremely easy to pick open, but when in an airport would someone have the time or the equipment to pick open your bag while you were not looking?
They all have a key override which is meant to only be supplied to the security officers so they dont have to cut off your padlock when they search your bag. If you do not have a TSA padlock then they will just cut it off and bin it. 
Some TSA padlocks come with a a colored indicator so you can tell that your bag has been searched, the indicator changes from red to green.

