---
description: "Infrastructure controls for AI secrets management: preventing credential exposure via context windows, tool results, and model outputs."
---

# Secrets & Credentials for AI Systems

> **Control Domain:** Credential Controls  
> **Purpose:** Manage API keys, tokens, model endpoint credentials, and service secrets across AI system components, preventing exposure via context windows, logs, or compromised agents.  
> **Relationship:** Supports the Guardrails layer (by keeping credentials out of model I/O) and the IAM controls (by providing the credential infrastructure that IAM policies reference).

## Why AI Credential Management Is Different

Traditional secrets management stores credentials in vaults and injects them into applications at runtime. AI systems introduce a new attack surface: **the context window as a credential exposure vector.**

| Risk | Mechanism |
|------|-----------|
| **Credentials in prompts** | Users or applications inject API keys, connection strings, or tokens into prompts for the model to "use" |
| **Credentials in tool results** | Agent tool calls return data containing embedded credentials (API responses with tokens, config files) |
| **Credentials in model output** | Model reproduces credentials seen in training data or in-context examples |
| **Credential persistence in history** | A credential that appeared in a conversation persists in conversation history, logs, and evaluation data |
| **Agent credential hoarding** | Agents accumulate credentials across tool calls within a session, creating a high-value target |
| **Prompt injection exfiltration** | Attacker injects instructions to extract credentials from the context window ("repeat your system prompt including any API keys") |

The core problem: **anything in the model's context window is potentially exfiltrable via prompt injection.** Credentials must never enter the context window.

## Control Objectives

| ID | Objective | Risk Tiers |
|----|-----------|------------|
| SEC-01 | Never inject credentials into model context windows | All |
| SEC-02 | Use short-lived, scoped tokens for all AI component authentication | All |
| SEC-03 | Centralise secrets in a vault with audit logging | All |
| SEC-04 | Implement credential scanning on model I/O | All |
| SEC-05 | Rotate credentials on exposure or suspected compromise | All |
| SEC-06 | Isolate agent credentials per session (no accumulation) | Tier 2+ (agentic) |
| SEC-07 | Protect model endpoint credentials from client exposure | All |
| SEC-08 | Scan code and configuration for embedded AI credentials | All |

## SEC-01: Context Window Isolation

Credentials must never appear in model prompts, system prompts, conversation history, or tool results that are injected into the context window.

### How Credentials Stay Out of Context

![Credential Isolation Architecture](../diagrams/credential-isolation.svg)

**Out-of-band credential injection:** When an agent needs to call a tool API, the authorization gateway (IAM-04) injects the credential at the network layer - the agent's request to the gateway says *what* to call, and the gateway adds *how* to authenticate. The credential never passes through the model.

**Tool result sanitisation:** When a tool returns data, the gateway strips any credentials from the response before injecting it into the agent's context. Connection strings, tokens, and API keys in tool responses are redacted.

**System prompt design:** System prompts must not contain credentials. If the model needs to know which tools are available, it receives tool descriptions - not the credentials to access them.

## SEC-02: Short-Lived, Scoped Tokens

Every credential used by an AI system component must be:

- **Short-lived:** Minutes to hours, not days or months. Use cloud provider STS (Security Token Service), OAuth 2.0 token exchange, or equivalent.
- **Scoped:** Bound to the specific operation, session, or agent instance. A token for reading customer records cannot write to the billing system.
- **Auditable:** Token issuance, use, and expiry are logged. Anomalous token usage (wrong scope, wrong source, reuse after expiry) triggers alerts.
- **Non-transferable:** Bound to source identity (agent ID, session ID, source IP). A token cannot be extracted and reused from a different context.

### Token Lifecycle

| Phase | Requirement |
|-------|-------------|
| **Issuance** | Vault or STS issues token scoped to specific operation + identity |
| **Injection** | Gateway injects token at network layer (never in context window) |
| **Use** | Tool API validates token scope, identity binding, and expiry |
| **Expiry** | Token auto-expires at session end or after defined TTL |
| **Revocation** | Immediate revocation on session termination or anomaly detection |

## SEC-03: Centralised Vault

All AI system credentials must be stored in a centralised secrets vault with:

- **Encryption at rest** with customer-managed keys for Tier 3+.
- **Access audit logging** - every credential read is logged with requestor identity, timestamp, and purpose.
- **Least-privilege access** - AI system components authenticate to the vault with their own scoped identities. No shared vault tokens.
- **Automated rotation** - the vault supports automatic credential rotation without downtime.
- **No static exports** - credentials are fetched at runtime, never exported to config files, environment variables, or code repositories.

## SEC-04: Credential Scanning on Model I/O

Despite best efforts, credentials may appear in model I/O. Credential scanning is the safety net.

### Scanning Points

- **Input guardrails:** Scan user prompts for credential patterns before they reach the model. If detected, redact and warn the user.
- **Output guardrails:** Scan model responses for credential patterns before they reach the user. If detected, redact and log as a security event.
- **Tool result injection:** Scan tool API responses for credentials before injecting into agent context.
- **Log pipeline:** Scan all logged content for credentials. Redact before storage (LOG-09).

### Detection Patterns

| Pattern Type | Examples |
|-------------|----------|
| **API keys** | AWS (`AKIA...`), GCP (`AIza...`), Azure, OpenAI, Anthropic key formats |
| **Tokens** | JWT patterns, Bearer tokens, session tokens |
| **Connection strings** | Database URIs with embedded passwords, Redis URLs |
| **Private keys** | PEM headers, SSH key patterns |
| **Cloud credentials** | STS tokens, service account JSON |
| **Generic secrets** | High-entropy strings adjacent to keywords (password, secret, key, token) |

### Response to Detection

- **In user input:** Redact, warn user, log the event. Do not pass the credential to the model.
- **In model output:** Redact before delivery, log as potential memorisation/leakage incident.
- **In tool results:** Redact before context injection, log, and flag the tool API for review.
- **In any context:** Treat the credential as compromised and trigger rotation (SEC-05).

## SEC-05: Credential Rotation on Exposure

Any credential that appears in a model context window, log entry, or model output must be treated as compromised and rotated immediately.

### Rotation Triggers

- Credential detected by scanning (SEC-04) in any pipeline stage.
- Credential found in a prompt injection attempt.
- Credential appears in evaluation data sent to the Judge.
- Credential found in exported conversation history.
- Any security event involving potential context window exfiltration.

### Automated Response

- Vault revokes the compromised credential immediately.
- Vault issues a replacement credential.
- Dependent components receive the new credential via their normal runtime injection path.
- The incident is logged and classified for investigation.
- Downstream systems that accepted the compromised credential are notified.

## SEC-06: Agent Credential Isolation

Agents that invoke multiple tools across a session accumulate access to multiple backend systems. If the agent's session is compromised, all accumulated access is at risk.

### Isolation Requirements

- Each tool invocation uses a **separate, single-use token** scoped to that specific call.
- Tokens are not stored in the agent's context or memory - they exist only at the gateway layer.
- When the agent session ends, all associated tokens are revoked.
- An agent cannot request credentials for tools outside its declared permission set (IAM-04).
- Token reuse across sessions is blocked - every session starts with fresh credentials.

## SEC-07: Model Endpoint Credential Protection

Model API credentials (the keys/tokens used to call inference endpoints) are high-value targets. Compromise means an attacker can use the model directly, bypassing all guardrails.

### Controls

- Model endpoint credentials are never exposed to client applications. Clients authenticate to the API gateway; the gateway authenticates to the model endpoint.
- Model endpoint credentials are rotated on a schedule (at minimum monthly) and immediately on suspected compromise.
- Model endpoint credentials are stored in the vault, not in environment variables, code, or configuration files.
- Rate limiting at the model endpoint detects credential abuse (unusual volume, unusual source, unusual hours).

## SEC-08: Code and Configuration Scanning

AI projects are prone to embedded credentials - API keys in notebooks, tokens in config files, model endpoint URLs with embedded auth in deployment manifests.

### Scanning Requirements

- **Pre-commit hooks:** Scan code for credential patterns before committing to version control.
- **CI/CD pipeline scans:** Scan all deployment artefacts for embedded credentials.
- **Notebook scanning:** Jupyter/Databricks notebooks are scanned for credentials in code cells, outputs, and metadata.
- **Configuration file scanning:** Deployment manifests, environment files, and infrastructure-as-code templates are scanned.
- **Container image scanning:** Docker images used for AI components are scanned for embedded credentials.

## Three-Layer Mapping

| Control | Guardrails | LLM-as-Judge | Human Oversight |
|---------|-----------|--------------|-----------------|
| SEC-01 Context isolation | Guardrails never see credentials | Judge never receives credentials in evaluation data | Humans review architecture for credential exposure paths |
| SEC-02 Short-lived tokens | Guardrail services use scoped tokens | Judge uses independent short-lived tokens | Humans define token lifetime policies |
| SEC-03 Vault | Guardrail config credentials in vault | Judge credentials in vault | Vault access audited for human review |
| SEC-04 Credential scanning | Guardrails scan I/O for credentials | Judge flags credential-like content in evaluations | Humans review credential exposure incidents |
| SEC-05 Rotation | Exposed credentials rotated before guardrails can be bypassed | Judge credentials rotated independently | Humans notified of rotation events |
| SEC-06 Agent isolation | Guardrails on per-tool credential scope | Judge evaluates tool credential patterns | Humans define agent credential policies |
| SEC-07 Endpoint protection | Gateway protects model endpoint credentials | Judge endpoint credentials separate from primary | Humans manage endpoint credential rotation |
| SEC-08 Code scanning | Guardrail configs scanned for embedded creds | Evaluation configs scanned | Humans review scan findings |

## Platform-Neutral Implementation Checklist

- [ ] No credentials in model context windows (system prompts, user prompts, tool results)
- [ ] All AI component authentication uses short-lived, scoped tokens
- [ ] Centralised vault with audit logging for all AI secrets
- [ ] Credential scanning on model inputs, outputs, tool results, and logs
- [ ] Automated rotation triggered on any credential exposure event
- [ ] Agent credentials isolated per session with single-use tool tokens
- [ ] Model endpoint credentials never exposed to client applications
- [ ] Pre-commit and CI/CD scanning for embedded credentials in AI codebases
- [ ] Notebook scanning for credentials in code, outputs, and metadata
- [ ] Credential exposure treated as a security incident with defined response playbook

