LLMs, GenAI, RAG, agents, evaluation · insight-1607
Mint short-lived, narrowly scoped credentials per agent run
- Evidence type
- practitioner heuristic
- Difficulty
- medium
- Roles
- ML engineer, Applied AI
- Industries
- finance, saas
Summary: situation, action, reason, boundary
Situation
An agent's tools authenticate with a long-lived API key that sits in an environment variable or config file the agent runtime can read.
Action
Have a credential broker issue a token per run or task, limited to the tools used and the requesting user's resources, expiring in minutes. Keep it inside the tool executor, never in the prompt or tool results, and log each issuance.
Reason
Temporary credentials expire by themselves and spare applications from embedding long-term keys; OWASP's excessive-agency guidance asks for extensions to run in the user's context with limited scopes, and its prompt-injection page asks that the application, not the model, holds the API tokens.
Boundary
Agents that call cloud, database or SaaS APIs on a user's behalf.
Symptom or risk
The key lands in a transcript, a trace or a tool output through injection or debug logging, and then works for months against everything.
Exceptions
Offline batch jobs with no model-visible text may use a dedicated service identity, still narrowly scoped.
Trade-offs
A broker adds latency and an operational dependency.
Pitfalls
Short expiry on a broad scope, and refresh tokens kept in the context window.
Lessons and concepts
Claims and their sources
AWS IAM documents temporary credentials as short-term, generated dynamically and unnecessary to embed in an application, and no longer accepted after expiry.
OWASP recommends executing extensions in the user's context with limited scopes and least privilege.
OWASP's prompt-injection page recommends least privilege and giving the application its own API tokens for extensible functionality.