Stop Hardening the Sandbox. Take the Credential Out of the Agent.

On March 29, 2026, K. Hartman of the SANS Institute published an IETF draft called Credential Broker for Agents, CB4A. It does something the agent-security conversation had not managed on its own: it names three architectural models for keeping a secret out of an agent’s process, rates each one by blast radius, and says which one it recommends. That converts a design preference into a rubric. You can now hand it to a vendor and ask which letter they implement.

Most agent-security budget goes somewhere else. It goes to constraining what an agent does with a credential it already holds: better tool scoping, tighter approval prompts, a guardrail model reading the output for anything that looks like a key. All of that assumes the secret is inside the process and the job is to police its exit. The prior question is whether it needs to be inside the process at all.

Christian Posta put the failure mode in one sentence: “Prompt injection, exfiltration, and accidental disclosure sound like three different attacks, but they’re just delivery mechanisms for the same failure mode: the bytes of a sensitive credential leave the agent and still work.” The last four words carry the weight. The loss happens when the bytes leave and still work.

Why Detection Is the Wrong Layer

The reason detection cannot be the primary control is architectural, and Simon Willison has stated it more plainly than anyone: “LLMs are unable to reliably distinguish the importance of instructions based on where they came from. Everything eventually gets glued together into a sequence of tokens and fed to the model.”

There is no privileged channel. A system prompt, a user message, a tool result, and a paragraph of hostile text scraped from a web page arrive at the model as the same kind of thing. Any control that depends on the model correctly ranking those sources is building on a property the architecture does not provide.

This is why guardrail vendors quoting detection rates are selling the wrong number. Willison again: “in web application security 95% is very much a failing grade.” A 5% miss rate against an attacker who can retry works as a filter, and filters are priced by how often an adversary is willing to knock.

Posta’s framing gives you the three architectural moves that actually change the outcome: “make the credential expire fast, make it non-transferable, or don’t give the agent a credential at all.” Those are ordered by how much they cost you and by how much they buy. The third one is the interesting one, and CB4A is what happens when someone writes it down as a protocol instead of a slogan.

The Three CB4A Models, Ranked by Blast Radius

The draft’s contribution is that it refuses to present the models as equivalent options. Each carries an explicit blast-radius rating.

Model A, proxy gateway. The agent never sees the credential. It emits a request to a broker, and the broker attaches the secret at the network boundary before the call reaches the provider. Blast radius: “minimal”. The bytes never enter the agent process, so no amount of context manipulation extracts what is not there. What an injection can still do is cause a request. That is an availability and abuse problem, not an exfiltration problem, and those are governed by different controls.

Model B, short-lived token minting. The broker issues the agent a token scoped to the operation with a short lifetime. Blast radius: “bounded by the TTL”. The credential is real and it is in the process, so a leak is a real leak. It is a leak with an expiry attached. The draft names this its “recommended primary model”, which is worth sitting with: the standards-track recommendation is not the strongest isolation. The draft gives no rationale for the choice, so read it as a bet on adoptability.

Model C, credential wrapping with scheduled revocation. The agent gets the real credential, wrapped, with revocation scheduled after the fact. The draft calls it the “weakest model” and rates the blast radius as “full until revoked”. If the window between compromise and revocation is where your protection lives, you are relying on detection again, one layer down.

Read against Posta’s three moves, the mapping is clean. Model C is roughly “expire fast” with the expiry moved to the wrong side of the compromise. Model B is expire fast, done properly. Model A is “don’t give the agent a credential at all.”

The Threat the Broker Creates

The pattern carries new risk of its own, and to the draft’s credit it says so first. Broker compromise, TM-1 in the threat model, is rated “CRITICAL, the only threat at that severity.” Every other entry sits below it.

That is the honest trade. Consolidating credentials behind a broker means you have replaced many medium-value targets with one high-value target. The argument for doing it anyway is the same argument that put your secrets in a vault rather than scattered across every service’s .env: a single component you can actually monitor, patch, rotate and audit beats a diffuse surface nobody owns. But the broker inherits the security posture your worst agent used to have, and it inherits it for all of them at once.

Worth noting for anyone quoting the draft in a design review: the CB4A text is not internally consistent on how many threats it enumerates. The abstract and the appendix disagree, ten in one place and eleven in the other. It is a draft. Cite TM-1’s severity, which is unambiguous, rather than a total count.

What This Costs You

A relay hop is a hop. The reference implementation described by WorkOS routes through headers (X-Relay-URL, X-Relay-User, X-Relay-Organization, X-Relay-Provider), forwards bodies “byte-for-byte up to 5 MB”, sets the upstream timeout at 30 seconds, and returns a 402 relay_authorization_required when the caller is not entitled to the credential. That last one matters more than it looks: an explicit error contract for “you are not allowed to use this secret” is what lets an agent fail cleanly instead of improvising.

On latency, WorkOS states directly that it has “not published latency numbers for the relay hop.” So do not let anyone, including us, tell you the pattern is performance-neutral. It adds a network hop in the path of every provider call, and the 5 MB body ceiling plus the 30-second upstream timeout are real constraints on what can move through it. Budget for both.

One more caveat on the figure the WorkOS post itself flags. The March 2026 TeamPCP incident is cited alongside this pattern, with a figure of 300+ GB of compressed credentials affecting roughly 500,000 corporate identities. That figure originates in the threat actor’s own extortion claim rather than in forensics. The same disclosure notes the actor used a generic host credential stealer, and that it was not an attack on LiteLLM’s stored provider keys. We wrote about a genuine supply-chain compromise in AI middleware separately, and the two should not be blended into one narrative. Use an unverified extortion number to justify a control and you hand the skeptic in the room an easy win.

Do This Now

Pick one agent that holds a provider credential today. Not the whole fleet, one agent.

Answer, in writing, which CB4A model it is running. If the credential is in the process for the life of the session, it is Model C by default, whether or not anyone chose it. Then find out what the credential can do at the provider: the scope, not the intent. In the audits we run, the token is usually broader than the agent’s job.

Then put the letter question to every agent vendor in your stack, in procurement language: which CB4A model do you implement, A, B or C, and what is your stated blast radius? A vendor who answers with a detection rate instead of a letter has told you the answer is C.

The taxonomy existing is what changed. Before it, “keep secrets out of the agent” was an opinion one architect held and another argued with. Now it is a draft with named models, rated severities, and a recommendation you can quote in a security review. That is a standard for what an agent is allowed to be, and it belongs in your containment architecture next to compute, data, knowledge and identity.

This analysis synthesizes Keeping credentials out of an AI agent’s context with Relay (WorkOS, Conner Simmons, August 2026).

Victorino Group helps engineering teams audit where agent credentials actually live and move them behind a broker boundary. Let’s talk.