Permit
The agent asks for the capability, not the key.
Credentials for connected systems live in a vault, scoped by agent, environment and tool. They are injected when a call is made and never placed in an agent's context — which means they cannot be echoed back by a model, logged in a transcript or extracted by somebody who writes a clever message.
Never in a prompt, never in code
A credential in a prompt is a credential in every log, transcript and error report that prompt touched. The platform has no mechanism for putting one there.
Scoped three ways
By agent, so one agent's compromise is not another's. By environment, so a sandbox cannot reach production. By tool, so a mail credential cannot be used against a ledger.
Rotation does not redeploy agents
Rotating a secret updates the vault. No agent changes, no version is created and nothing needs re-approving, because the agents never held the old value.
Redacted on the way out
Logs, traces and error messages are scrubbed. The most common way a secret leaks is not an attack — it is a stack trace pasted into a support ticket.
Permissions
The rest of this area.
Three states per capability, and the default is never.
Grants and scopes
Allow, approve or never — per capability, per agent.
Authority
Holding a tool is not the same as being allowed to use it freely.
Boundaries
What an agent can never do, however it is configured.
Permission reviews
Access granted for a reason that expired is the common failure.
Network policy
Where an agent may reach, and nowhere else.
Give AI a job.
Build an agent, choose what it can access, define what it may do, and deploy it to work safely across your business.
No code required · Full SDKs and API · Stop any agent instantly · [email protected]