AI Systems Atlas

S-18Secrets Broker

/security/secrets-broker

The agent never holds a raw credential: it requests an action, and a broker at the egress boundary attaches a scoped, short-lived one.

Step-by-step walkthrough2 variants · 11 steps

Key in context

  1. The simplest setup: the key lives in the environment, and the agent reads it like any other value.
  2. The agent attaches it to requests itself. It works — and the model now holds the literal secret.
  3. That key is broad and long-lived, and it lands in every transcript, trace and error the agent produces.
  4. An injected page asks the agent to print its environment.
  5. The key leaves — in a reply, a URL, a commit — and keeps working until someone rotates it.

Brokered

  1. The agent runs with no credential at all — only the ability to ask for an action.
  2. It requests an action, not a key: charge order 91.
  3. The broker checks the action against this run’s scope and fetches a token that covers only it.
  4. The credential is attached at the egress boundary, after the request has left the agent’s reach.
  5. The same injected page asks for the environment — then for refund(all).
  6. There is nothing to print, and an out-of-scope request is refused before any key is attached.
Key insight

Redaction tries to stop a secret from leaving; brokering means it was never there to leave. The model can be persuaded to print anything in its context, so the only safe credential is one outside it.

Failure mode

A broker that hands the token back to the agent “so it can make the call itself”. The key is in context again, and the broker has become a very elaborate environment variable.

Further reading
RelatedCredential leakageSandbox anatomyConfused deputy

Elsewhere in the atlas

Harnesses →Evals →Context →Coding Agents →Tools →Ops →