Platform holds approved credential
- Policy permits action
- Mediator retrieves from vault
- Inject at dispatch
- Agent receives result only
Solution
Keep reusable credentials out of agent context on governed routes
Policy decides on the exact action. The execution boundary acquires and applies credentials so the agent receives a governed result, not standing custody.
Illustrative workflow — not a live product screenshot. Scope and coverage apply.
Keep reusable credentials out of agent context
Three lanes show where the reusable credential is held versus what the agent receives.
Agent / model context
- 1.Proposed action
- 2.Opaque credential handle (if any)
- 3.Governed result
Governed execution boundary
- 1.Policy decision
- 2.Permit consumption
- 3.Credential mediator
- 4.Dispatcher
Reusable credential enclosed here
Target system
- 1.Bound request
- 2.Observed outcome
No reusable secret crosses this boundary
Applies to declared governed routes and controlled credential ingress paths. Does not include interactive RDP/SSH session proxying as a substitute for this model.
An opaque handle must not be independently redeemable by the agent or usable outside the governed execution boundary.
Legend
- Identity and context
- Execution
- Evidence and proof
What this diagram shows
- Agent lane: proposed action, optional opaque handle, governed result — no reusable secret.
- Execution boundary: policy, permit consumption, credential mediator, dispatcher.
- Target lane: bound request and observed outcome.
- No reusable secret crosses this boundary
- Applies to declared governed routes and controlled credential ingress paths. Does not include interactive RDP/SSH session proxying as a substitute for this model.
Three industry approaches
| Approach | Who holds secret | Duration | Reuse | Decision point | Evidence | Posture |
|---|---|---|---|---|---|---|
| Inject at the boundary | Vault / mediator at execution boundary | Action-bound | None in agent context | PEP at governed route | Consumption + dispatch records | EmpowerID default on governed routes |
| Broker short-lived, action-bound authority | Broker for narrow window | Single action or mission turn | Limited to bound scope | Policy + broker policy | Broker issuance + outcome link | Supported where broker integrates with spine |
| Hand over and revoke later | Agent or model context | Standing until revoked | High | After custody transfer | Revoke events only — not non-custody proof | Not our model |
Acquisition and ingress
User completes provider consent
- Request held at boundary
- User authorizes with provider
- Token captured and vaulted
- Later use is mediated — not pasted into model context
Secrets pasted or returned into model context require capture-and-substitute controls; output redaction alone is not equivalent.
Stronger ingress-control path: capture-and-substitute at the governed boundary (connector and deployment scope apply).
Separation of duties
Decision authority (PDP)
May: Evaluate policy and issue decision
Must not: Hold reusable credentials or dispatch directly
Execution verifier / fencer
May: Bind arguments and enforce permit consumption
Must not: Override policy or store long-lived secrets in agent context
Credential / control mediator
May: Acquire and apply credentials inside boundary
Must not: Authorize actions without policy decision
Dispatcher
May: Send bound request to target
Must not: Expand scope beyond consumed permit
Where this control holds, and where it does not
Governed
- Actions on declared governed routes
- Mediated credential acquisition and injection
Not governed
- Credentials the agent already holds from another source
- Paths that bypass the governed execution boundary
Possible bypasses
- Direct API access with standing keys held by the agent
Exposure ledger
Illustrative exposure ledger
| Identity / agent | Reachable credential | Mediated target | Purpose / mission | Last use | Expiry | Recert owner | Custody mode | Evidence |
|---|---|---|---|---|---|---|---|---|
| FinanceCloseAssistant | SAP service account (mediated) | ERP read API | Month-end read mission | Last governed turn | Mission-bound | Finance Ops | No standing secret in agent context | Dispatch + read-back on declared path |
| UnregisteredCopilotExtension | Unknown — not on governed path | HTTP egress | Unknown | Not observed on declared path | N/A | Unresolved | Review required | Gap — not on governed path |
Honest boundary
- Not a privileged-session recording product
- No RDP/SSH proxy claim on this page
- Non-custody applies only to governed paths
- A credential broker alone does not prove the downstream effect
Get Started
Connect once. Govern consistently. Change safely.
Request Demo See the platform in action
Talk to an Expert Technical consultation
