Orchestration & Agentic Security · Agent Authorization, Delegation, and Continuous Enforcement
Keep secrets out of the model's context
Verify that secrets and credentials required by an agent at runtime are not exposed within the model's observable context, including the context window, system prompts, or tool call parameters.
OWASP AISVS v1.01, requirement 9.5.4
In plain English
Keep secrets out of anything the model can see: the context window, the system prompt and tool call parameters. Whatever is in the context can be repeated in output, written to logs or drawn out by an injection.
What good looks like
- Credentials are added by the tool runtime after the model has made its call. The model never handles them.
- Prompts, tool arguments and tool results contain no secrets.
- Code-execution sandboxes do not inherit the host's credentials or environment variables.
- Prompts and logs are scanned for leaked secrets.
How teams usually do it
- A tool gateway or proxy that injects credentials server side. The model says "call the billing API" and the gateway attaches the key.
- For sandboxed agents, an egress proxy that adds credentials to outbound requests, so the secret never enters the sandbox.
- Secret scanning over prompts, transcripts and logs, with alerts.
Suggested evidence
- The tool call design, showing where credentials are attached.
- Scan results over a sample of prompts and logs.
- A test asking the agent to reveal its credentials, which it cannot do.
Common mistakes
- Putting an API key in the system prompt so the agent can "use it".
- Tools that return secrets in their results, such as a file-read tool pointed at an env file.
- Connection strings pasted into the chat by a developer and kept in the conversation history.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.