Vol. IX · The Agent-Computer Interface · IX.4
Secrets, Identity, Least Privilege
The agent is a principal. It gets the credentials of the job, not the credentials of the developer. Subagents inherit a subset. Logs never print secrets. Memory never stores them.
6 min read
Doctrine
- Inject secrets at the executor, as environment into a scoped sandbox, never into the prompt.
- Subagents get a reduced tool set and no parent tokens. A researcher does not get the deploy key.
- The agent's identity is explicit: which user, which tenant, which ticket. A2A auth exists because 'the model' is not a principal.
The executor holds the keys
The model should never see a raw secret. It should call send_email(ticket_id) while the executor attaches the tenant's token. OpenHands and E2B exist so even a jailbreak cannot reach host credentials. Cloudflare Agents bind identity to a Durable Object. A2A treats the other agent as a foreign principal with its own auth.
Anti-patterns
- Putting API keys in the system prompt 'so the agent can call vendors'.
- Subagents that inherit the parent's full secret bag.
- Writing .env into the workspace the model can read, then asking it not to.