I first ran across Infisical while spec’ing a provisioner that I’d planned for a multi-tenant cloud service. I needed a clean way of distributing secrets to a service that would execute queries on behalf of one client then free resources for others. Infisical is open-source and it unifies secrets management, private-CA certificate lifecycle, and privileged access brokering.
Recently, I read they’d added a new “Agent Vault” feature that’s interesting enough that I wanted
to share it. The mechanism is straightforward: an agent pointed at HTTPS_PROXY never receives
the actual credential at all. Agent Vault terminates the TLS connection, strips whatever the agent
tried to attach, injects the real secret from its vault, and re-establishes the connection to the actual
service. The agent completes the request having never held the key. Infisical’s Credential Brokering for
AI Agents, Explained post explains “if an agent can’t
be trusted with credentials, it shouldn’t have them.”
The pattern assumes the agent is untrustworthy and might very well spew any secrets it has in response to a sufficiently devious request, so it gives us the opportunity to hand the agentapi keys like “THISISNOTAKEY1234HAHA” in its keyring and step in with an adapter on a proper tool call. If the agent gets fooled into over-sharing, it just won’t have any damaging information to convey. If I were in a more threat-centric role, I might consider giving the agent real-looking creds that trigger security-related monitors whenever one is detected in output. I’m definitely filing this project into my how-to-handle-secrets-for-agents folder.