Agent securityAdvancedLesson 215 min read

Secrets, identity and who the agent really is

Every agent action happens as somebody. Getting that somebody right is the difference between an audit trail and a shrug.

🧪 Lab · 15 min 📝 Lesson test

Lesson in motion

In 60 seconds

Secrets, identity and who the agent really is

Every agent action happens as somebody. Getting that somebody right is the difference between an audit trail and a shrug.

1/6

In simple words

If everyone in the building shares one name badge, and something goes missing, you cannot tell who took it. Give every helper their own badge.

Rule one: the model never sees a secret

If an API key enters the context window, it can be written into a URL, echoed into an error message, or summarised into a log. Once text is in context, assume it can come out.

Wrong

"Here is the API key: sk-... Use it to call the service."
Secrets pasted into the system prompt.
Environment variables the agent's code can read and print.
One long-lived key shared by every agent.

Right

The model calls send_invoice(id); the tool holds the key.
Secrets live in a vault, fetched by tool code at call time.
Short-lived tokens, minted per run, expiring in minutes.
A separate identity per agent, per environment.

The secret and the model never meet. An injected agent can ask for an invoice to be sent — which your action guardrails can limit — but it cannot steal a credential that was never in front of it.

Rule two: agents are identities, not accounts

Question	Bad answer	Good answer
Who did this?	`svc-ai-prod`	`agent:support-triage` on behalf of `user:4471`
What can it do?	Whatever the service account can	A scoped role listing exact permissions
How long?	Forever	15 minutes, then re-issued
How do we stop it?	Rotate a shared key and break everything	Revoke one identity in one action
Which version acted?	Unknown	Recorded: agent version, model, prompt hash

Danger

If you cannot revoke one agent's access without breaking the others, you do not have an incident response plan. You have a hostage situation.

Rule three: every action carries the end user

Two identities matter on every call: which agent and on whose behalf. Both must be attached by your runtime, outside the model's reach. If the model can set the user ID in a tool argument, the model can set someone else's.

A practical secrets checklist

No secrets in prompts, ever. Grep your prompt templates for key, token, password today.
No long-lived credentials in an agent's environment.
One identity per agent per environment; never share across dev and prod.
Short expiry, automatic rotation, one-click revocation.
Secret scanning on model output and on logs, because logs leak too.
An owner named for every credential the agent can use.

Do this

If you do one thing from this module: find every place a secret enters a prompt, and move it behind a tool. It is usually an afternoon of work and it removes an entire category of incident.

Watch and read more

Secrets management basicsYouTube search Machine identity and workload identityYouTube search

Lab

A secret your model literally cannot leak, because it never sees it.

~15 min

The problem

Take an agent that currently receives an API key in its context. Refactor so the model calls send_invoice(order_id) and the tool fetches a short-lived credential and makes the call. Then try to make the agent reveal the key.

Starter codepython

# BEFORE — the key is in the prompt, one injection from a query string
SYSTEM = f"You are an assistant. Use API key {API_KEY} to call the billing service."

# AFTER — the model names an action; the tool holds the credential
def send_invoice(order_id: str) -> str:
    token = vault.issue("billing", ttl_seconds=300)      # minted per call
    return billing.post(f"/invoices/{order_id}", token=token)

You are done when

grep of every prompt template finds no key, token or password
The agent cannot reveal the credential under any prompt you try
The token expires in minutes and is revocable independently

Hard questions

Try to answer before you reveal. If you can answer these, you understood the lesson.

Q1An error message from the billing service includes the token. Where does it end up, and what do you change?Reveal

Straight into the model's context as a tool result, and from there into logs, summaries and possibly the user's screen. Two changes: sanitise tool errors before they re-enter context — return a stable code and log the detail server-side — and run secret-pattern detection on both context and logs. Never pass an upstream error through verbatim; it is untrusted content that you also authored.

Q2Design the identity model for an agent acting for many users, so that one compromise does not expose everyone.Reveal

Two identities on every call, both attached by the runtime: the agent's own scoped service identity, and a per-request delegated token for the acting user, minted at request time with the narrowest scope and a lifetime shorter than the task. Authorisation is enforced at the data layer against the user token, so the blast radius of a compromised agent is the set of users whose requests are in flight, not every user who ever used it. Log both identities on every action, or your audit trail cannot answer the first question anyone asks.

Please sign in to continue.

Questions people ask

What if a tool genuinely needs the user's own credentials?

Use delegated authorisation — OAuth-style — so the user grants a scoped token that your code holds and the model never reads. The model triggers the action; the token stays out of context.

Should agents have their own accounts in every system?

Yes, with the narrowest role that works. It costs a little setup and it is what makes your audit log answer questions instead of raising them.

How short should tokens be?

Shorter than a run. Minutes, not days. If a token outlives the task, a leak outlives the task too.

What about agents that need to act while nobody is logged in?

Then the agent's own identity is the actor, and its permissions must be scoped assuming no human will notice for hours. Overnight autonomy and broad permissions is the combination that produces morning surprises.

Lesson test

5 questions. Get 3 right (60%) to pass and complete this lesson.