Module 15 · Chapter 9: Permission gates and secrets
Secrets out of the agent's reach
In short
An agent never needs to see a secret's value: tools read keys on the server side. Deny secret files, mask traces, scan before commit, and when a leak happens revoke the key first, then clean up.
After this lesson you can
- Keep keys and secrets out of the agent's context and logs
- Prepare scanning and rotation for when a secret leaks
Sign in to read this lesson
The title and summary are open to everyone. The full lesson is for signed-in learners.