Credential management for AI agent deployments

AI agents need credentials to access tools, APIs, and data sources. How you manage these credentials determines the blast radius when something goes wrong. A compromised agent with admin credentials is a catastrophic failure. A compromised agent with read-only, scoped credentials is a contained incident.

Principles

Least privilege

Every credential should have the minimum permissions needed for the agent's task:

• Database credentials: read-only access to specific tables
• API tokens: scoped to specific endpoints and methods
• File system access: restricted to specific directories
• Cloud credentials: limited to specific services and resources

Unique credentials

Each agent instance should have its own credentials. Sharing credentials between agents means you cannot revoke one without affecting others, and you cannot attribute actions to a specific agent in the audit trail.

Short-lived credentials

Prefer temporary credentials over long-lived ones:

• OAuth tokens with short expiration
• AWS STS temporary credentials
• Short-lived database session tokens

If a credential is stolen, it stops working after the expiration period.

Storage

Never store credentials in code, configuration files, or environment variables in plain text on disk:

• Use a secrets manager (HashiCorp Vault, AWS Secrets Manager, GCP Secret Manager)
• Inject credentials at runtime, not build time
• Encrypt secrets at rest

// Good: fetch from secrets manager
const dbPassword = await secretsManager.getSecret('agent-db-password');

// Bad: hardcoded
const dbPassword = 'hunter2';

Rotation

Rotate credentials on a regular schedule:

• API keys: every 90 days
• Database passwords: every 90 days
• Service account tokens: every 30 days

Automate rotation so it happens without manual intervention.

Monitoring credential usage

Track how credentials are used:

• Which agent used which credential
• What actions were taken with each credential
• Anomalous usage patterns (unusual time, volume, or actions)

Authensor receipts record which tools were called but not the underlying credentials (credentials should not appear in logs). Monitor credential usage at the infrastructure level through API gateway logs and database audit logs.

Emergency revocation

Have a process for immediately revoking an agent's credentials:

# Revoke all credentials for a specific agent
vault token revoke -accessor <agent-accessor>

Test this process regularly. When an incident occurs, you need to revoke credentials in minutes, not hours.

Defense in depth

Even with good credential management, assume credentials can be compromised. Layer credential controls with:

• Policy enforcement (limits what the agent can do even with valid credentials)
• Network egress controls (limits where the agent can send data)
• Behavioral monitoring (detects unusual credential usage patterns)