What breaks when credentials are removed from prompts but not from the access model?

The access model still allows persistent authority even if the model never sees the secret. If standing credentials remain available to the agent or its broker, the system can still perform unintended actions. Secret concealment reduces exposure, but it does not replace least privilege, expiry, or policy enforcement at execution time.

Why This Matters for Security Teams

Removing a secret from a prompt reduces one exposure path, but it does not change what the agent, broker, or downstream service is still allowed to do. If standing authority remains in the access model, the system can still create resources, call APIs, exfiltrate data, or chain tools after the prompt no longer displays the credential. That is why secret concealment is not a control boundary.

This gap shows up most clearly in non-human identity programs that treat credentials as the only risk. NHIMG’s Ultimate Guide to NHIs — Static vs Dynamic Secrets frames the real issue: dynamic secrets matter, but only when paired with least privilege and expiry. OWASP’s OWASP Non-Human Identity Top 10 also treats over-permissioned workload identities as a core failure mode, not a side effect.

In practice, many security teams encounter abuse only after an agent has already been allowed to act far beyond the original intent, rather than through intentional access design.

How It Works in Practice

The failure starts when teams remove credentials from the model prompt and assume the problem is solved. The model may no longer see the token, but the surrounding system still holds persistent authority through a broker, workload identity, cached session, or attached role. If the agent can request actions on behalf of that identity, the real control plane is unchanged. The question becomes: what can the agent do at execution time, under this specific context?

Current guidance suggests three controls matter most. First, use workload identity as the primitive for the agent, not embedded secrets. Second, issue just-in-time credentials with short TTLs so authority exists only for a task window. Third, evaluate policy at request time, using context such as tool name, target resource, data sensitivity, and agent state. NIST’s NIST SP 800-53 Rev 5 Security and Privacy Controls supports this least-privilege posture, while NIST SP 800-63 Digital Identity Guidelines helps distinguish proof of identity from mere possession of a credential.

• Use ephemeral tokens per task, not long-lived secrets in memory or config.
• Bind access to workload identity and runtime policy, not to prompt contents.
• Revoke or expire credentials when the task ends, fails, or changes scope.
• Log tool calls and authorization decisions separately from model output.

NHIMG’s Guide to the Secret Sprawl Challenge shows why hidden secrets often keep circulating through side channels, caches, and brokered access paths even after prompt hygiene improves. These controls tend to break down when shared service accounts and broad cloud roles are used because the agent inherits more privilege than any single task requires.

Common Variations and Edge Cases

Tighter prompt hygiene often increases operational overhead, requiring organisations to balance reduced secret exposure against more complex runtime access design. That tradeoff becomes especially visible in multi-agent systems, where one agent calls another or hands off work across tool chains.

There is no universal standard for this yet, but current guidance suggests the same principle everywhere: if the access model stays static, the risk stays static. Even when prompts are clean, a planner agent, retriever, or execution broker can still inherit broad authority and turn a small request into a large blast radius. This is where agentic systems differ from conventional applications. They are goal-driven, so pre-defined role maps often fail to describe what the agent will do next.

NHIMG’s 52 NHI Breaches Analysis is useful here because it shows how often identity failures involve standing access, not just leaked material. The same pattern appears in credential theft research: Entro Security’s findings on LLMjacking report that when AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes. The operational lesson is simple: concealment helps, but only policy, expiry, and least privilege change the attack surface.

Related resources from NHI Mgmt Group

• What breaks when organisations disable the user but leave credentials and tokens active?
• How should security teams run access reviews for non-human identities?
• How should security teams govern non-human identities that have persistent access?
• When do NHI access reviews create more value than a one-time cleanup?