Secrets, OAuth and Least-Privilege Identity for AI Agents

Evidence check: 25 October 2026. Product details reflect the referenced documentation observed at this cutoff; exact plans, prices, regional eligibility and unverified release dates are not claimed. This is an editorial guide, not a hands-on test.

Keep secrets out of the prompt

API keys and refresh tokens belong in a secure credential store accessed by a trusted executor. A tool call carries a narrow operation request, not reusable secrets. An agent’s full transcript, retrieval cache and telemetry are easier to copy or inspect than a proper secret store. Never embed high-privilege environment variables in a browser controlled by the model.

Identity at every step

Map an action to a real user, service principal and allowed resource. Validate the target record and scopes at execution time. A user allowed to view an account summary may not be allowed to export its raw data or delete it. Avoid the “confused deputy” failure in which an agent uses its broad system account to fulfill a lower-privilege user’s request.

MCP and delegated access

MCP’s authorization examples illustrate OAuth discovery and protected operations. That is a transport and identity mechanism, not a complete security policy. Tools still need handler-level ownership checks and audit logging. Separate a read-token from a write-token; rotate credentials and ensure revoked access is honored in already queued tasks.

Browsers and sandboxes

Computer-use documentation recommends isolated environments, explicit allowlists and no inherited host secrets. Disable unnecessary local filesystem access and extensions. If a browser is authenticated, treat it as a sensitive session with short lifetime and limited reachable sites. Require approval before transmitting personal data, even when the action looks like filling an ordinary form.

Multi-tenant and long-running work

Persist only credential references, never raw tokens, in agent checkpoints. Refresh short-lived credentials at the moment of the allowed action. Re-evaluate authorization when a human approval is finally received. If a tool or model provider changes, review where data leaves the organization’s boundary and update the permission inventory.

Verification exercises

Try to fetch another tenant’s record, execute a stale approval, follow an injected URL to an unapproved domain and use a revoked connector. The enforcement layer should deny these attempts before the external call occurs. Publish the written threat model and tested outcomes, not an unsupported statement that an SDK is inherently secure.

Credential separation in practice

A document research agent could need a public web tool and a read-only knowledge-base token. It does not need the organization’s administrator API key. Issue tokens to the service component, not to the model text context, and perform allowlist checks immediately before execution. Log the requesting identity and exact capability used without printing secret values. Rotate leaked credentials independently from model or prompt changes.

Handle delegation and revocation

When a user asks an agent to act on their behalf, confirm how the target API represents delegated rights and token expiry. Prevent the agent from retaining privileged credentials after the session or task ends. An external MCP server, plug-in or agent endpoint is a separate security principal; treat it as an external integration with reviews for data access, network egress and auditability. Test revocation in the middle of an in-flight workflow and make unauthorized actions fail closed, while preserving enough state for safe escalation.