Credentials and Secrets
Eliminating standing credentials from agent execution contexts — the highest-leverage control in the framework.
Eliminate standing credentials from agent execution contexts. This is the highest-leverage control in the framework. The scale argument is straightforward: non-human identities now outnumber human users by roughly 45 to 1 on average and 144 to 1 in cloud-native environments, 78 percent of organizations have no documented policy for creating or removing AI identities, and only 20 percent operate a formal process for offboarding and revoking API keys.12 Weak non-human identity management was cited in 41 percent of identity-related incidents in a 2026 survey of 5,000 security leaders across 17 countries.13
Minimum bar (L2). No secrets in code, images, environment variables, or prompts. All credentials vaulted, scoped to the narrowest resource set that permits the function, and rotated on a defined schedule.
8.1 Controls #
| ID | Control | Minimum bar (L2) | Enforced state (L3) |
|---|---|---|---|
| CRED-1 | Ephemeral task-scoped credentials | Credential lifetimes are defined per credential type and enforced by expiry rather than by rotation policy alone, set to the shortest interval the workload will tolerate. Median and 95th-percentile lifetime across the agent estate are measured and reported rather than estimated. | Ephemeral, task-scoped credentials issued at point of use with lifetimes measured in minutes, not days. |
| CRED-2 | Scope containment on compromise | Credentials reachable from each agent runtime are enumerated and scoped to that agent’s declared function. No credential in an agent execution context grants access to another agent’s resources, or a broader role than the registry entry declares. Reviewed at deployment and on any scope change. | No credential reachable from a compromised agent process that grants access beyond that agent’s declared scope. |
| CRED-3 | Workload-bound credentials | Credentials are issued to a named workload identity rather than shared across runtimes, using the platform’s native workload identity mechanism—SPIFFE/SPIRE, cloud workload identity federation, or equivalent—in place of long-lived static keys wherever the platform supports it. | Credentials bound to workload identity and, where supported, to the specific action being performed. |
| CRED-4 | Credential leakage detection | Secret scanning applied to agent logs, transcripts, and outputs on the same footing as source repositories, with a defined response path when a hit occurs. Memory and vector stores are in scope, even if scanned on a schedule rather than inline. | Automated detection of credential material appearing in agent context windows, memory stores, logs, or outputs. |
| CRED-5 | Tested revocation | A documented revocation procedure for every credential type an agent can hold, with a named owner and a target time-to-effect. Exercised at least annually against a live credential rather than assumed to work. | Revocation that completes in minutes and is tested, not assumed. |
8.2 Evidence to Request #
- A demonstration: compromise a test agent’s execution context and enumerate what credentials are obtainable and for how long they remain valid.
- Median credential lifetime across the agent estate.
- Time-to-revoke, measured from a live test.
8.3 Failure Modes #
- Vaulting treated as sufficient. Retrieving a long-lived secret from a vault into the runtime produces a standing credential with extra steps.
- Rotation schedules that exist on paper and fail silently.
- Agents given a single credential covering the union of everything they might ever need, because scoping each tool separately was more work.
References cited in this section
2 of 32 · numbering matches the PDF
- 12"The Non-Human Identity Governance Vacuum: AI Agents and the Fastest-Growing Unmanaged Attack Surface," Cloud Security Alliance Lab Space, May 20, 2026.labs.cloudsecurityalliance.org/research/csa-whitepaper-nonhuman-identity-agentic-ai-governance-v1-cs ↗
- 13"State of Identity Security 2026," Sophos, May 12, 2026 (survey of 5,000 security leaders across 17 countries). †www.sophos.com/en-us/whitepaper ↗