TL;DR: AI-native development now hinges on ephemeral access design, not secret visibility alone, as 1Password says its Codex integration keeps secrets out of prompts, code, and model context by injecting credentials at runtime and limiting them to approved sessions.
At a glance
What this is: 1Password's Codex integration is a just-in-time access pattern for coding agents that injects credentials at runtime and keeps secrets out of prompts, code, and model context.
Why it matters: It matters because IAM teams now have to govern when AI agents may receive credentials, not just where secrets are stored, and that changes how runtime access, approval, and offboarding work.
Context
Coding agents change the access problem because they do not just consume software, they also need credentials to reach databases, APIs, and deployment pipelines. That creates a governance gap when teams rely on copied secrets, hardcoded credentials, or prompt-based access that is too easy to leak or reuse.
The control question is no longer whether credentials exist, but whether they are ever exposed to the agent, the developer workstation, or the model context window. For NHI governance, that shifts the focus from secret storage alone to runtime issuance, approved execution, and short-lived access scope.
Key questions
Q: What breaks when coding agents are given persistent credentials instead of just-in-time access?
A: Persistent credentials break the assumption that access can be safely reviewed after issuance. Coding agents can use the secret immediately, then finish the task before any access review or rotation window catches up. That creates a governance gap where exposure happens before oversight. The fix is to bind credential lifetime to the execution window, not the user account.
Q: Why do AI coding tools increase secrets risk?
A: AI coding tools increase secrets risk because they can accelerate the reuse of insecure patterns across repositories, test fixtures, and automation scripts. The issue is not the model inventing credentials, but the way generated code can spread bad defaults faster than human review can catch them.
Q: How do security teams know if just-in-time access is actually working?
A: Look for short-lived sessions, automatic revocation, and complete request-to-access logs. If approvals are still creating durable permissions, or if teardown depends on manual cleanup, then the programme is only partially ephemeral. Effective JIT should leave little or no reusable privilege behind after the task ends.
Q: Who should own governance when human and AI agent identities share workflows?
A: Identity, security, and platform teams should share ownership, but accountability must be explicit and tied to the workflow owner. Shared workflows collapse responsibility quickly unless each action can be traced to a specific identity and authority chain. That is especially true when agents operate inside developer or browser environments.
How it works in practice
Runtime credential injection for coding agents
Runtime injection means credentials are issued only when an approved process or session starts, then withdrawn when that execution ends. In this model, the agent can complete its task without the secret ever being written to disk, copied into a prompt, or reused in later sessions. The technical distinction matters because the access path is ephemeral and contextual, not durable. That makes the credential part of the execution envelope rather than a standing artifact that can be harvested later. Practical implication: treat runtime issuance as the control point, not the vault alone.
Practical implication: control access at issuance time, not after the secret has already been exposed.
Why context windows are a governance boundary
Model context is not a safe place to store credentials because anything inside it can be surfaced, copied, or retained beyond the intended task boundary. Once a secret enters prompts, code, or terminal output, the organization has already lost a key governance property: it can no longer prove that access was limited to an authorized runtime. For AI-native development, context contamination becomes a policy failure as much as a technical one. Practical implication: design workflows so credentials are referenced, not revealed, and keep the agent’s operational scope separate from its context.
Practical implication: keep secrets outside model context and audit for any workflow that reveals them.
Just-in-time access for agentic workflows
Just-in-time access fits agentic development because the access need is task-scoped and temporary rather than persistent. Traditional secret handling assumes a person or service will reuse the same credential over time, but coding agents may need access only for a single build, test, or deployment action. That means the lifecycle has to include approval, issuance, use, and expiry inside one bounded workflow. Practical implication: align credential lifetime with the smallest executable unit, not the longest possible developer session.
Practical implication: set credential lifetime to the shortest meaningful task boundary.
NHI Mgmt Group analysis
Runtime access is becoming the governing unit of identity for coding agents. The old model treated secrets as possessions to store and rotate, but AI-native development turns them into transient permissions that must exist only long enough to complete a single task. That makes issuance, approval, and expiry more important than secret visibility alone. Practitioners should start treating runtime as the boundary that matters.
Persistent credential assumptions fail when an AI agent is the executor. A credential designed for reuse presumes a stable, human-paced session, but coding agents can request, consume, and finish work inside a much tighter execution window. That breaks the governance premise behind standing access and post-hoc review. The implication is that access control must move upstream to the moment of task authorisation.
Secrets outside context is now a governance requirement, not a convenience. Once credentials appear in prompts, code, or terminal output, the organization loses control over where they can be copied or replayed. This is the identity blast radius problem in agentic development: one exposed credential can affect multiple systems if the workflow allows broad downstream use. Practitioners should minimise the number of places a credential can exist at all.
Machine identity, human approval, and agent execution are converging in the same workflow. The article shows how developer authentication, agent runtime access, and machine-bound credentials now intersect inside a single delivery path. That convergence means identity teams cannot keep separating human IAM from NHI governance when the same workflow depends on all three. The practitioner conclusion is to govern the full execution chain, not just the user login.
Codex-style integrations widen the control surface for delegated access. These workflows are not just about whether an agent can call a tool, but whether the organisation can prove what it was allowed to touch, for how long, and under whose approval. That moves identity governance closer to runtime policy enforcement than to static entitlement management. Practitioners should re-check whether their current controls can express session-bound authority at all.
From our research library:
- Claude Code-assisted commits leaked secrets at a rate of 3.2%, more than double the human-only baseline of 1.5%, with peaks reaching 31 secrets per 1,000 commits in August 2025, according to the State of Secrets Sprawl 2026.
- Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap, according to the State of Secrets in AppSec.
- Read next: Ultimate Guide to NHIs — Static vs Dynamic Secrets
What this signals
Ephemeral credential trust debt: AI coding workflows accumulate risk when teams keep treating reusable secrets as if they were safe inside agentic sessions. The control problem is not just leakage after the fact, but the assumption that a secret can remain valid across a workflow that is itself transient.
Access reviews are a poor fit for credentials that may exist only for a single build, test, or deployment action. If the permission disappears before recertification, governance has to shift toward issuance-time controls and approval evidence instead of retrospective review cycles.
24,008 unique secrets were exposed in MCP configuration files in 2025 alone, the protocol's first year of widespread adoption, according to the State of Secrets Sprawl 2026. That scale shows why runtime access design has become a core identity governance issue for agentic development.
For practitioners
- Instrument just-in-time issuance for agent workflows Require credentials to be issued only inside approved execution paths and expire them when the task ends, not when a person logs out.
- Remove credential material from prompts and repositories Replace copied secrets, hardcoded values, and local credential files with vaulted references so the agent never sees the raw secret.
- Separate developer context from credential context Keep model prompts, code generation, and terminal output isolated from secrets so a coding agent cannot surface or retain usable credentials.
- Review approval gates for agentic execution Confirm that runtime access for AI agents still requires an explicit approval point before database, API, or deployment credentials are released.
Key takeaways
- Coding agents change the identity problem because access now has to be governed at runtime, not only protected at storage.
- Secrets that reach prompts, code, or local files create a wider exposure path than traditional human-only workflows.
- Just-in-time credential issuance is the control that narrows the blast radius when AI agents need temporary access.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10, OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI03 — Identity & Privilege Abuse | The article focuses on agentic workflows receiving and using credentials at runtime. |
| Recommendation — Constrain agent credentials to approved execution scope and audit every privilege grant. | ||
| OWASP Non-Human Identity Top 10 | NHI-02 — Secret Leakage | Secrets must stay out of prompts, code, terminals, and model context. |
| NHI-07 — Long-Lived Secrets | The piece argues against persistent credentials for AI-native development. | |
| Recommendation — Prevent NHI secret leakage by issuing credentials only at runtime and never exposing raw values. Replace long-lived credentials with short-lived, session-bound access for agent workflows. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Runtime credential issuance and expiry are central to the article's control model. |
| Recommendation — Use IA-5 to govern issuance, rotation, and revocation of agent-facing authenticators. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article is about authorising AI agents only under approved conditions. |
| Recommendation — Apply PR.AA-05 to keep agent entitlements tied to explicit approval and task scope. | ||
| MITRE ATT&CK | TA0006;TA0010 — Credential Access; Exfiltration | The threat path described is secret exposure followed by credential reuse or theft. |
| Recommendation — Map leaked-secret workflows to TA0006 and TA0010 and hunt for exposed credential paths. | ||
Key terms
- Just-in-Time Access Request: Just-in-Time Access Request is a pattern that grants access only when it is needed and only for the duration required. It reduces standing privilege by making access temporary, policy driven, and task scoped. This approach is especially useful for contractors, sensitive systems, and short-lived operational work.
- Model Context Window: The model context window is the set of information an AI system can see and use during a run. For identity governance, it matters because secrets placed here can be echoed, stored, or reused by downstream tools, turning a temporary credential into an exposure event.
- Runtime Credential Injection: Runtime credential injection is the practice of delivering a secret only inside an authorised execution session instead of storing it in files, prompts, or code. It keeps the credential available long enough to do the work while reducing the number of places it can be copied or leaked.
- Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 10, 2026.
Updated on October 10, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org