A security team identifies that in the current multi-agent system, the orchestrator passes its own GitHub authentication token to sub-agents in environment variables so they can perform API operations. What security risk does this pattern introduce, and what is the correct alternative?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Handing your master key to every employee who needs to open any door is not delegation — it is a credential disaster. Each sub-agent should have its own narrowly scoped key, not a copy of the orchestrator's master key. The correct answer is B.
Full explanation below image
Full Explanation
The anti-pattern of passing the orchestrator's authentication token to sub-agents creates two significant security problems.
First, permission scope violation: the orchestrator's token is scoped to everything the orchestrator needs to do, which may include repository administration, organization management, or other elevated permissions. Sub-agents typically need much narrower permissions. A sub-agent receiving the orchestrator's token gains all the orchestrator's permissions, violating least privilege.
Second, blast radius amplification: if any sub-agent is compromised through prompt injection, vulnerability exploitation, or misconfiguration, the attacker obtains the orchestrator's full-permission token. This is equivalent to compromising the most privileged agent in the system through any one of potentially many sub-agents.
The correct alternative is independent credential isolation: each sub-agent authenticates with its own credential scoped to exactly the permissions it requires. The orchestrator does not delegate its own credential — instead, each agent in the system is independently provisioned with appropriate credentials at deployment time.
Option A is incorrect because token expiry is a separate concern from the permission scope problem, and extending token lifetime would make the security situation worse, not better.
Option C is incorrect because storing the token in a shared database makes the credential accessible to any agent or service that can query the database, which is potentially a larger blast radius. It also does not address the core permission scope problem.
Option D is incorrect because base64 encoding is not encryption. Base64-encoded values are trivially decoded by any process that reads them. This provides zero security benefit — it is security theater.