# Agent credentials: issue the smallest useful secret and prove you can revoke it

Source: https://www.web3sec.news/blog/agent-secrets-scope-and-recovery
Updated: 2026-11-08

Assign owners and record supporting evidence in your team's own system.

- [ ] Assign a task-specific identity and record its revocation owner.
- [ ] Inspect indirect access through files, helpers and secret stores.
- [ ] Keep real credentials out of prompts, repositories and generated reports.
- [ ] Never grant valuable secrets to untrusted build instructions.
- [ ] Prove expired/revoked access fails and review residual sessions and authority.

## References
- [OWASP: secrets management lifecycle and access](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)
- [Docker: build secrets and secret mounts](https://docs.docker.com/build/building/secrets/)