An agent should never possess the credentials that authorize its most sensitive actions. Agents accumulate secrets the way workstations accumulate files: database passwords, repository tokens, service credentials, and provider API keys, sitting in environment variables, configuration files, and the agent's own context window. Every one is a target, and an agent is a system that can be talked into things. An injected instruction to print the environment is among the oldest tricks in the field, and with an open-weight model whose instruction-following you cannot verify, sound design assumes the instruction succeeds.
Four ways to handle an agent's keys
| Approach | Where the usable key exists | What theft yields | Rotation cost |
|---|---|---|---|
| Static key in config or env | On the endpoint, always | A reusable key, valid until noticed | Touch every endpoint |
| Vaulted key, fetched at use | On the endpoint, during use | A reusable key, shorter window | Central; keys can be exposed or cached on the endpoint during use |
| Short-lived workload identity | On the endpoint, briefly, narrowly scoped | A short-lived token, bounded audience | Central and automatic |
| Substituted key | Never on the endpoint | A substitute with no standalone value | Central; endpoints never touched |
The first three form the familiar hygiene ladder, and joint agency guidance recommends verified agent identity with short-lived credentials for exactly this reason. Each rung shortens the exposure, and in many conventional implementations they share a limit: at the moment of use, a usable key reaches the endpoint, where the agent, and anything that has compromised the agent, can read it.
Substitution at the enforcement point
The stronger pattern removes the credential from the endpoint entirely. The flow has five steps. The agent is issued a substitute: a stand-in credential bound to the enforcement point and the verified agent session, with no standalone value anywhere else. The agent makes its outbound call presenting the substitute. The enforcement point verifies the agent's identity and its declared authorization for this destination. It replaces the substitute with the real credential, which stays inside the trusted control plane and is injected only here. The request goes forward, and the exchange lands in the evidence record. The real key never reaches the agent's endpoint: not its memory, not its configuration, not its context window. No enterprise AI credential remains on the endpoint to steal.
Follow the failures through
Prompt exfiltration: a model with quietly absent alignment receives an injected instruction to exfiltrate its keys and complies, exactly as the design assumed it would; what leaves is the substitute, which has no standalone value outside the authorized path and context. A malicious skill harvesting credentials, the ClawHavoc pattern, comes away with the same worthless substitute. Full endpoint compromise: an attacker with the whole machine holds a substitute honored only at the enforcement point, for the destinations that agent identity was declared for, with every use logged centrally. A copied substitute used from elsewhere fails identity verification at the enforcement point, and the attempt itself is a high-quality alert.
Rotation, revocation, and the unavailability question
Rotation becomes a control-plane operation: the real key rotates centrally, and no endpoint is touched because no endpoint ever held it. Revocation is immediate and equally central: disable the substitute or the agent identity, and every dependent path closes at once. And ask any platform, this one included, the unavailability question: what happens to governed calls when the enforcement point is down. The right answer is that they fail closed by default; any emergency bypass is explicit and audited, and no path, emergency or otherwise, delivers the provider key to the endpoint, because one that does converts an availability incident into a credential exposure.
Honest scope
Two notes keep the claim precise. Substitution applies where the service interaction is mediated through a governed session path; local capabilities, such as filesystem credentials, SSH access, and tools that never traverse the session layer, need short-lived, audience-bound workload identity and OS-level isolation instead. And substitution prevents theft of a reusable key; it does not prevent a compromised agent from abusing the session it is authorized to hold, which is why reachability, content controls, rate limits, and revocation still apply.
Prove it in ten minutes
The pattern has a clean proof: during an active agent session, inspect the endpoint. Environment, configuration files, process memory of the agent. The test passes when no reusable provider credential is present anywhere on the machine while the agent is successfully calling the governed service. Few security claims can be verified directly this quickly. The full proof adds three more artifacts: an endpoint packet capture showing only the substitute on the wire, the enforcement-point trace showing the injection, and provider-side logs showing the real key used only from the enforcement point.
Where the control plane fits
Enterprise provider credentials terminate at the AI Session Controller: the agent presents a substitute, the ASC verifies identity and authorization, injects the real key on the governed path, and records the exchange. Ask for the ten-minute endpoint inspection as part of any evaluation.
