No. In MING Labs’ production fleet, no agent holds an OAuth token, an API key, or a database credential. All secrets live in a gateway layer: agents request actions, the gateway authorises them against the agent’s declared tool surface and executes the approved ones itself.[S1] An agent that is compromised, confused, or simply wrong can change what it asks for. It cannot change what it is granted.
01The bright line, and why it is architectural
Most agent security guidance is procedural: scope the keys carefully, rotate them often, hope every agent’s configuration keeps up. The credential-free rule is different in kind. If the agent never holds a secret, there is no key to leak, no token for an injected instruction to exfiltrate, and no per-agent configuration to drift. A rogue agent can do nothing the gateway has not authorised, and that guarantee does not depend on the model behaving well. It is a policy turned into physics: not enforced on the agent, but absent from it.[S1]
The tool surface that the gateway enforces is declared per agent, in the agent’s job description, and versioned. A typical surface reads like an access grant for a new employee: read and draft in email, read in the knowledge base, read and write notes in the CRM. Sending to a new outbound domain escalates to a human. Anything not declared is denied.[S1]
02The risk is permissions, not model quality
OWASP’s Top 10 for LLM applications names the failure mode precisely. LLM06:2025, Excessive Agency, attributes agentic damage to three root causes: excessive functionality, excessive permissions, and excessive autonomy. Its recommended mitigations are to restrict extensions to the minimum necessary permissions, execute in the least-privileged context available, and require human approval before high-impact actions.[S2] None of those mitigations mention model quality, because the damage path does not run through it: a perfectly aligned model holding an over-scoped credential is one good prompt injection away from misusing it.
| Where credentials live | Blast radius of a compromised agent | What revocation takes |
|---|---|---|
| Inside each agent | Everything every held key reaches | Finding and rotating every copy, per agent |
| In a shared vault agents can read | Everything the vault grants that agent, at injection time | Re-scoping vault policy, per agent |
| In a gateway; agents hold nothing | The agent’s declared tool surface, nothing else | One change, one place, logged |
03What this makes answerable
The pattern’s quiet payoff is auditability. Because every external action flows through one mediating layer, the question “what can this agent reach?” has a reproducible answer at any point in time, in writing, with a change history, and the question “what did it reach?” is a log query rather than a forensic project. Isolation completes the picture: each agent runs in its own container with no shared filesystem and no shared network namespace, and encryption keys are separated per region and rotated quarterly.[S1] Those answers are precisely what an agent’s audit trail has to contain, and this architecture produces them as a by-product of running.
04The claim, scoped
Scope
- The rule: agents hold no production secrets. A gateway layer holds all credentials, authorises requests against each agent’s declared tool surface, and executes approved actions.
- Where it runs: MING Labs’ own production fleet, per-agent container isolation, since January 2026.
- Enforcement artefacts: per-agent tool surface declared and versioned in the agent’s job description; deny-by-default for undeclared actions; human escalation for new outbound destinations; quarterly key rotation.
- Not claimed: a product, an industry standard, or a compliance certification. This is one firm’s operating architecture, published as a working reference.
Credential-free agents are one half of a larger discipline: giving an agent exactly the access its role requires is the same act as giving it a role at all. That is why the tool surface lives in the agent’s job description rather than in a config file, and why changing it follows the same approval path as changing the job. How that hiring discipline works, and why it beats deploying tools, is the subject of hire, don’t deploy ; what the whole operating model looks like is described under hybrid organisation .
