Secrets Management in Agent Workflows

The connector needed a service key. The intern put it in the system prompt so the model would know how to call the API. The key began to appear in traces, then in an eval export, then in a screenshot a vendor shared internally. Nobody had stolen it. Everybody had filed it.

Secrets in agent workflows fail in boring ways. They sit in prompts, in planner environment files, in tickets, in chat traces, in core dumps, in demo videos. The model does not need to be clever. It needs to be asked to print its configuration by someone who already found the public desk, or by an insider who opened the debug view.

This guide is for CISOs on 17 August 2026. Not legal advice. The authentication article designed the doors. This one hides the keys. CERT-In's 180-day logs should contain use of secrets, not the secrets. DPDP does not want a second copy of a database password next to a citizen's name in a trace.

Prcept will not accept a key in a prompt. If that is how the current SI integrated, we start by rotating and moving it.

What counts as a secret here

Tool credentials, database passwords, signing keys, webhook tokens, model-host keys, encryption keys for the corpus, break-glass passwords, and the session keys of officers if you were foolish enough to cache them.

System prompts are not secrets in the cryptographic sense, but they are standing orders. Do not paste them into public answers. Do not treat them as keys either. A prompt is not a vault.

Retrieval chunks that happen to contain keys — old circulars with test passwords, wikis, exported configs — are secrets you ingested. Corpus review is secrets management.

The planner must not hold the crown

The planner proposes a verb. The connector, sitting next to a vault or a local issuer, mints a short-lived credential for that verb and that object. The planner never sees the long-lived key. If the model is injected, it can ask for a verb it does not have. It cannot print the crown.

This is the same idea as least privilege. Secrets are how privilege is implemented. A fat key in an env file is a fat grant with worse hygiene.

On a gapped estate the vault is local. Air-gap is not an excuse for a password in a text file on the desktop of ai-prod.

Where secrets may live, and where we still find them.

Place	Allowed?	If found
Vault / HSM / local issuer	Yes, with audit	—
Connector memory, short TTL	Yes	Rotate if dumped
Planner prompt or tools JSON	No	Rotate, rewrite, incident
Traces, eval, tickets, chat	No	Rotate, purge, notify
Corpus / wiki / circular scan	No	Purge all stores, rotate

Rotation, revoke, and the night

Every secret has an owner and a rotation clock. Machine credentials should be short enough that rotation is normal, not heroic.

Revoke must work when a planner host is dirty, when an insider leaves, and when a trace leak is discovered at 21:40. Practise it. If revoke is a vendor change window, you do not manage secrets. You subscribe to them.

Log access to the vault. Dual-control on production secret read. The insider article is the people half. This is the key half.

• No secret in any prompt, including examples.
• No long-lived key on the planner.
• No secret in traces; redact at source.
• No screenshot of a config as evidence in a ticket.
• Corpus scanners that look for key-shaped strings.

When a secret leaks

Rotate first. Argue later. Assume the value is public the moment it has been in a trace or a ticket.

Map the effect. A leaked read key for public circulars is embarrassing. A leaked write key for a register is unauthorised-access territory under existing CERT-In types. Do not invent an AI secret code.

Purge the value from logs you control. You may not be able to purge a vendor's copy. That is why the secret should never have gone to a vendor debug channel.

Objections you will hear — and what to do with them

These are the lines that stall the file. Answer them in the room, then put the answer in the note. A spoken answer without paper will be forgotten by the next officer.

The model needs the key to call the API.

The connector needs the key. The model needs a verb name. If your framework requires the model to hold the secret, the framework is the incident.

Vaults are heavy for a pilot.

A local vault or even a locked issuer with short TTLs is lighter than a rotation after a screenshot. Pilots with production keys are production.

We encrypt the env file.

Encryption at rest on a file the planner decrypts at startup still means the planner holds the crown. Better than nothing. Not the design.

Redacting traces will hurt debug.

Debug in a clean room with synthetic secrets. Production traces with live keys are how debug becomes a leak.

A ten-day secret amnesty

Assume every prompt and ticket is dirty. Rotate, then design.

1. Day 1: hunt keys in prompts, repos, tickets, traces, corpora. Treat finds as live.
2. Day 2: rotate everything found. Do not wait for a perfect inventory.
3. Day 3–5: move long-lived keys off the planner into a vault or issuer. Connector mints short tokens.
4. Day 6–7: redact traces at source. Rebuild eval without secrets.
5. Day 8: dual-control vault read. Alert on secret print patterns.
6. Day 9–10: revoke drill. CISO signs the handling note.

How this shows up in the file

Subject: Secrets handling — agent [name].

Long-lived keys live in [vault], owner [post]. Planner holds none. Connector mints TTL [n] for verb [list]. Traces redact secret-shaped values at source. Corpus scanned on [date]. Rotation clock: [period]. Revoke tested [date]. Leak response: rotate first, map CERT-In by effect, no invented type. Not legal advice.

A key in a prompt is a finding, not a configuration.

Tutorials are hostile input

Most leaked agent keys we see did not come from a nation-state. They came from a tutorial that put the secret in the system prompt, an error message that printed a bearer token, or an eval export that left the room. Hunt those three first. Rotate what you find before you finish the inventory.

Frameworks that require the model to hold the key are the incident. The model needs a verb name. The connector needs the vault. If a bidder's reference architecture pastes a key into tools JSON, mark the architecture fail and ask for a connector design.

On a gapped estate the vault is local. That is not an excuse for a text file on the desktop. Short TTL, dual-control read, revoke that works at 21:40. The gap is not a secrets manager.

This article is informational field guidance for Indian public institutions, not legal, procurement, security-accreditation or engineering advice. Confirm against the current Gazette, GFR, GeM term, CVC instruction, CERT-In direction, DPDP text, departmental manual and your counsel before you file it.

How to fail this before citizens do

“Secrets Management in Agent Workflows” is a path problem. A P4 Security/CISO should be able to name the tool, the identity, the secret and the egress that would make “secrets management AI agents” real. If the only control is a network diagram from last year, you have a story, not a threat model.

If the planner can read the payment key, the citizen can eventually ask it to. Vault the secret, mint a short token, never log the value, never put it in a prompt. Air-gap is not automatically secure. Prompt injection is not a conference joke when the agent can write a ticket. CERT-In still wants specified logs in India and incidents on a six-hour clock. Write those clocks into the runbook.

1. Red-team the write tools, not only the chat UI.
2. Kill undeclared outbound paths on staging.
3. Redact personal data from logs you will actually keep.
4. Scope a pentest that includes RAG and connectors.
5. Cap metered spend so a loop cannot empty a budget.

Close this loop before the next CAB

Put “Secrets Management in Agent Workflows” on the next change-advisory or bid-opening agenda as a single line item with an owner. If it cannot earn a line item, it will not earn a control. The owner should be a P4 Security/CISO, not “the vendor.”

Revisit the item when the model, the GeM term, the region, or the SI changes. “secrets management AI agents” is not a one-time workshop. It is a watch item. Date the last check. Unsigned watch items are souvenirs.