Keep Agent Secrets Out of Prompts
Keep provider credentials in a server-side broker and test that prompts, tool results, and logs never expose them.
An agent may need a tool that calls a provider API. It does not need to see the provider credential in its prompt, retrieved context, or tool arguments. A model-visible secret can be repeated in a response, retained in traces, or copied into another tool call. OWASP's secrets guidance calls for controlled storage and limited exposure; the same rule applies to AI workflows.
Put credentials in a broker or server-side secret store. The model requests a named operation, and the tool resolves the credential after authorization. Give the model an opaque connection label if it must choose among accounts. That label must not be usable as a bearer token.
Secret-flow map
| Step | Allowed data | Excluded data |
|---|---|---|
| User prompt | Task and safe account label | API key or password |
| Model tool request | Operation and validated object ID | Authorization header |
| Tool broker | Secret reference and policy | Secret in log message |
| Provider call | Credential over approved channel | Credential in URL |
| Tool result | Minimal status and safe fields | Raw provider debug dump |
Review every place a prompt is assembled. System messages, conversation memory, retrieval chunks, tool descriptions, and error strings can all carry copied credentials. A "do not reveal" instruction does not undo exposure. If a secret has already entered model-visible context, follow the provider-side incident and rotation process; deleting the chat alone may not revoke the credential.
Leakage fixture
Use a synthetic marker that looks like a key but has no authority. Pass it through an owned mock provider response and a failed tool call. Search prompts, model requests, traces, audit events, and final answers for the marker. Confirm the intended task still succeeds when the broker supplies a separate mock credential.
Test a missing secret too. The tool should fail with a safe configuration error, not ask the model to collect the key from the user. Record the credential owner, scope, rotation path, and broker component in the review. Never run this test with a real production key. If the tool cannot work without placing a credential in model context, hold it out of the agent's available tool set.
Know what your agents can reach
Map data access, tool actions and approval boundaries before testing. Use the scope guide, or discuss a review of your AI application.