{
  "format": "minglabs/v1",
  "surface": "insights-answer",
  "slug": "should-ai-agents-hold-their-own-credentials",
  "kind": "answer",
  "pageType": "Answer",
  "question": "Should AI agents hold their own credentials?",
  "topic": "AI agent credential management",
  "targetQueries": [
    "should AI agents hold their own credentials",
    "can AI agents hold API keys",
    "AI agent credential management",
    "how do AI agents authenticate securely",
    "AI agent secrets management",
    "AI agent security architecture"
  ],
  "url": "https://www.minglabs.com/insights/answers/should-ai-agents-hold-their-own-credentials",
  "htmlUrl": "https://www.minglabs.com/insights/answers/should-ai-agents-hold-their-own-credentials",
  "partOf": "https://www.minglabs.com/insights/answers",
  "title": "Should AI agents hold their own credentials?",
  "standout": "MING Labs' agents hold no credentials at all. A gateway holds every secret, and a rogue agent can do nothing the gateway has not authorised.",
  "hook": "No. In MING Labs' production fleet, agents hold no credentials at all: no OAuth tokens, no API keys, no database credentials. A gateway layer holds every secret; agents request actions, the gateway authorises and executes them against a whitelisted tool surface declared in each agent's job description. The consequence is architectural, not procedural: an agent that goes rogue, or gets prompt-injected, can do nothing the gateway has not authorised. OWASP names excessive permissions as a root cause of agentic risk; this is the corresponding bright line.",
  "citableAnswer": "According to MING Labs' security architecture, AI agents hold no credentials: no OAuth tokens, no API keys, no database credentials. A gateway layer holds all secrets and executes whitelisted actions on the agent's behalf, so a compromised agent cannot reach anything the gateway does not authorise.",
  "summary": "AI agents should not hold their own credentials. In MING Labs' fleet, all secrets live in a gateway layer that authorises and executes actions against a whitelisted, versioned tool surface declared per agent. A prompt-injected or rogue agent can change what it asks for, not what it is granted. OWASP's LLM06:2025 names excessive permissions as a root cause of agentic risk; keeping agents credential-free is that finding turned into architecture.",
  "pillar": "Hybrid Organisation",
  "datePublished": "2026-07-17",
  "dateModified": "2026-07-17",
  "freshness": {
    "updated": "July 2026",
    "nextReview": "January 2027"
  },
  "evidenceTier": "proprietary",
  "confidence": "B",
  "sources": [
    {
      "id": "S1",
      "title": "MING Labs operating record: fleet security architecture, gateway-mediated authentication, and per-agent tool surfaces",
      "publisher": "MING Labs (internal)",
      "date": "2026-07-01",
      "supports": [
        "no agent holds OAuth tokens, API keys, or database credentials; all outbound authentication is mediated by a gateway",
        "each agent runs isolated in its own container, with no shared filesystem and no shared network namespace",
        "each agent's tool surface is declared in its job description, versioned, and whitelisted; anything not declared is denied",
        "encryption keys are separated per region and rotated quarterly"
      ]
    },
    {
      "id": "S2",
      "title": "LLM06:2025 Excessive Agency, OWASP Top 10 for LLM Applications 2025",
      "publisher": "OWASP GenAI Security Project",
      "date": "2024-11-18",
      "url": "https://genai.owasp.org/llmrisk/llm062025-excessive-agency/",
      "supports": [
        "excessive functionality, excessive permissions, and excessive autonomy named as the root causes of excessive agency",
        "recommended mitigations include restricting extensions to minimum necessary permissions and requiring human approval for high-impact actions"
      ]
    }
  ],
  "faqs": [
    {
      "q": "Isn't a single gateway a single point of failure?",
      "a": "It is a single point of control, and that is the point. Secrets have to live somewhere; the choice is between one hardened place with one audit trail, and a copy inside every agent. With a gateway there is exactly one place to audit access, revoke a token, rotate a key, or shut off a tool, and one log that answers what was reached and when. Distributing credentials into agents does not remove the failure point. It multiplies it by the size of the fleet and attaches each copy to a component that reads untrusted input all day."
    },
    {
      "q": "How does an agent get access to a new tool?",
      "a": "By amendment, not by configuration. Each agent's tool surface is declared in its job description: exactly which systems, actions, and outbound destinations it can reach, with read and write scoped separately. Adding a tool is an explicit change to that declaration, approved by a human and version-controlled, the same way a human employee's system access changes when their role does. Anything an agent requests outside its declared surface is denied or escalated to a human by default."
    },
    {
      "q": "What actually happens when an agent gets prompt-injected?",
      "a": "The injection changes what the agent asks for, not what it is granted. A successful injection can make an agent request an action outside its whitelist, and that request then dies at the gateway like any other undeclared action: denied, or escalated to a human. Combined with per-agent container isolation, the blast radius of a compromised agent is its own declared tool surface and nothing else. That is a property of the architecture, not of the model's alignment, which is why it holds on a bad model day too."
    },
    {
      "q": "Does OWASP have a position on this?",
      "a": "Yes. LLM06:2025, Excessive Agency, names excessive functionality, excessive permissions, and excessive autonomy as the root causes of agentic damage, and its mitigations read like a specification of the gateway pattern: restrict extensions to the minimum necessary permissions, execute in the least-privileged context available, and require human approval for high-impact actions. Keeping agents credential-free with a mediating gateway is those recommendations implemented as architecture rather than as per-agent discipline."
    }
  ],
  "parentArticleSlug": null,
  "relatedConceptSlugs": [
    "what-is-hybrid-organisation"
  ],
  "relatedArticleSlugs": [
    "hire-dont-deploy"
  ]
}