AI Agent Security (Course)
Credential Brokering
Also: credentials outside the sandbox
Keeping secrets outside the environment an agent runs in and attaching them to approved requests at an outside gateway.
In more detail
Instead of placing an API key or token in the agent's environment, the sandbox has no credentials and sends requests to a gateway that checks scope and policy, then inserts the credential as the request leaves. A compromised or injected agent then has nothing to read and nothing to send. Google described this design for its Agent Compute Engine; it reduces what theft can yield but does not stop an agent misusing the access the gateway still grants.