Requirements
- The agent names the credential a tool needs, and the agent does not hold the secret.
- One component resolves that name at the moment the tool runs, and gives the value to that single action.
- Nothing else reads stored secrets.
- The agent cannot print, log, or pass on the secret value.
- An agent that acts for a person gets the use of only the credentials its own tools named. It never receives the secrets themselves.
- The system checks each use of a credential as it happens. Withdrawing a credential stops the next action that needs it, and the conversation keeps running.
Security considerations
Assume the agent's own code is wrong, or under attacker control. The attacker can then read the agent's memory, its environment, and its logs. The secret is absent from all three. The attacker therefore obtains the use of a credential while the agent runs, and never the credential itself. Withdrawal takes effect without stopping the work.
Residual risk: An attacker in control of the agent can still invoke any tool whose credential the agent may name, while the agent runs.
Non-qualifying systems
Commonly substituted components: a secrets manager, or tokens placed in the environment before the agent starts. Any of the following disqualifies a system:
- Every secret the agent might need is present before any tool asks for one.
- The secret exists as a value the agent can read, print, or pass on.
- Withdrawing one credential means restarting the agent.
- Any process the agent spawns inherits the environment, and therefore the whole set of secrets.