08.04 · Concept
Credentials an agent can reach
Keep an agent's tools from becoming a path to every key in the environment.
Agent credential exposure is the real permission boundary: any environment variable, config file, metadata endpoint, token mount, or local secret reachable by its runtime can become usable through a tool call. Treat each tool as a separate service identity, remove ambient authority, scope credentials tightly, and verify the agent cannot reach unrelated keys.
What this lesson answers
- what credentials can an agent access
- how to stop agents reading environment secrets
- least privilege credentials for agent tools
Notes
An agent is not just code that calls a model; it is a process with tools, files, network access, and whatever credentials its runtime can reach. If the agent can read environment variables, config files, cloud metadata endpoints, shell history, CI tokens, SSH keys, or mounted service-account tokens, then a prompt-injected task may turn those into capabilities. The security question is not “do we trust the model?” but “what can this whole execution context do if steered badly?”
The right mental model is to treat each tool invocation as a small service with its own identity and least-privilege…
Common questions
- Why is hiding secrets from the prompt not enough?
- The model does not need to see a secret for the agent to use it. A callable tool, shell command, dependency, config loader, or runtime library may read the credential and act with it. The safe boundary is what the whole execution context can access, not what text is visible in the prompt.
- What should agent tool credentials look like?
- Each tool should have its own narrow identity with only the permissions required for its job. Prefer temporary, brokered credentials over shared long-lived secrets. A database tool should not inherit cloud admin access, and an issue triage tool should not run with deployment keys just because they share infrastructure.
- Is read-only access safe for an agent?
- Read-only access can still expose customer data, source code, tickets, logs, cloud inventory, embeddings, and internal system details. It can also help an attacker discover more powerful credentials or attack paths. Treat read access as sensitive and scope it to the exact resources the agent needs.
Short definition: what is Credentials an agent can reach?