What does "the agent never holds the key" mean? Credential custody for AI agents
Credential custody means the provider API key lives with the system that makes the call, not with the agent. What the agent holds instead, what it protects against, and where it stops applying.
Credential custody means the provider credential for an AI agent's action, such as a Stripe or GitHub key, is held and used by the system that makes the call, so the agent names the action and never holds the key itself.
Without Anlyon agent -> your API credential -> production API
With Anlyon agent -> named action -> Anlyon -> production API
Why does it matter who holds the key?
Whatever is in the agent's context, environment or tool arguments can leak through the agent. A stray sentence in a web page, a ticket or an email can ask the model to print its environment or send a request somewhere new. If the Stripe key is not in the agent's runtime, there is no Stripe key to steal there.
A key the agent holds also defines what the agent can do. A Stripe secret key can do far more than refund one charge. Custody moves that power to a fixed action definition.
What does the agent hold instead?
An Anlyon key, scoped to the actions it may invoke. The action references the provider secret as {{secret:NAME}}, and Anlyon resolves it at dispatch.
import { Client } from '@anlyonhq/sdk';
// Once, from an operator key. The credential appears here and nowhere else.
const ops = new Client({ apiKey: process.env.ANLYON_OPERATOR_KEY! });
await ops.secrets.put('STRIPE_KEY', {
value: process.env.STRIPE_KEY!,
allowedHosts: ['api.stripe.com'],
});
// An action named 'refund-order' sends it as 'Bearer {{secret:STRIPE_KEY}}'.
// The agent's side: an action name and input. No URL, no header, no key.
const agent = new Client({ apiKey: process.env.ANLYON_AGENT_KEY! });
await agent.actions.invoke('refund-order', { charge: 'ch_3P9x', amount: 12000 });
Four properties keep the key where it is:
- The vault is write-only. No API returns a secret's value.
- A secret is bound to a destination and a placement, checked again at fire time. On an action with no declaration, the host is checked again and the placement is not.
- An action that carries a secret has a fixed host. An input cannot choose where the credential is sent.
- Response bodies are stored with secret values redacted.
Where does credential custody stop?
- It covers credentials in the vault, not a key your own process already holds. Remove direct provider keys and other write paths from the agent's runtime, or the agent can still go around the action.
- It is a property of the hosted path. With the local
approvals.gate()wrapper, your process runs your function with your credential. - A tool your own code calls directly is not routed through Anlyon and is not governed by it.
- Custody limits what leaks, not what the action allows. Pair it with a shared limit and a bound approval on the actions that matter.
Related terms
Read next
Frequently asked questions
What does "the agent never holds the key" mean?
It means the provider secret stored in Anlyon's vault is absent from the agent runtime. The agent holds an Anlyon key scoped to the actions it may invoke. The action references the secret as {{secret:NAME}}, and Anlyon resolves it at dispatch. It covers credentials in the vault, not a key your own process already holds.
Can an agent read the secret back from Anlyon?
No. The vault is write-only, and no API returns a secret's value. Reads return names and metadata. Referencing a secret in an action definition requires the secrets:read scope, and invoking that action needs actions:invoke and nothing else.