Specialist agents need database credentials and third-party API key…

Question

Specialist agents need database credentials and third-party API keys at runtime. Today secrets are environment variables baked at deploy time and rarely rotated. How should you design secrets management?

Accepted Answer

Retrieve secrets at runtime from Azure Key Vault using the agent’s managed identity, enforce RBAC on secret access, enable rotation, and avoid baking long-lived secrets into images or prompts — B is the Azure-standard approach. Key Vault for secrets/certificates, managed identity auth, RBAC on who can get which secret, and rotation policies—without baking secrets into images, git, or prompts. Git commits leak. Prompt-stored keys appear in traces and logs. One concatenated mega-secret destroys least privilege and rotation granularity. Wire agents to fetch just-in-time secrets with their own identities.

Answer

Commit secrets to the agent Git repository in a secrets.json file for transparency

Answer

Put API keys in system prompts so the model can “remember” them across sessions

Answer

Share one Key Vault secret named “all-keys” as a single concatenated string for every agent

Specialist agents need database credentials and third-party API keys at runtime. Today secrets are environment variables baked at deploy time and rarely rotated. How should you design secrets management?

Short Explanation

Full Explanation