A media company lets agents deploy preview sites, but recent logs exposed an API key because it was pasted into prompts and stored in chat history. Security now requires least-privilege access that survives log sharing. Which secrets management consideration protects credentials when agents and workflows run?

The correct consideration succeeds because referencing secrets from a managed vault and injecting them only as runtime environment variables keeps plaintext out of agent reasoning, prompt text, source code, and persisted logs, while the vault enforces least-privilege scoping, auditing, and rotation even when logs are exported or shared externally. Centralizing in a vault with rotation but injecting through a shared preview service identity improves hygiene over hardcoding yet fails least privilege because any compromised preview inherits all permissions and blast radius cannot be limited per agent, site, or workflow. Fetching scoped secrets at runtime with dashboard redaction improves scoping and rotation yet fails safe sharing because masking only in the viewer leaves raw values in underlying log stores, exports, and forwarded bundles that preserve the original leak. Delivering short-lived scoped secrets directly to agents for authenticated calls improves expiry and scope yet fails prompt safety because any value visible to the model can be interpolated into tool arguments, echoed in reasoning traces, and retained in chat history, recreating the reported API key exposure. An exam caveat is to distinguish transport security and rotation from visibility control, since rotation and TLS do not cure a secret that was already expanded into prompts or logs. A practical check is to deploy a canary preview, export raw logs to an external viewer, and verify the secret never appears, the access is denied outside its scope, and no prompt or history field contains the value.