The shape of the guarantee
The guarantee rests on three properties:- A value is delivered for the run that needs it by default, not held by the agent between runs.
- A raw value never passes through your browser or a deployment, so it is not sitting in a console screenshot, a manifest, or a build log.
- A binding, not an account membership, grants access. Being an agent in the account does not give you the account’s secrets.
The path a secret takes
1
You store it
A credential holds either a single secret value or a set of named keys under one name. Once
stored, it is not readable back out through the console — the screen manages the credential, not
its contents.
2
You bind it
A credential is bound to the agents allowed to use it. An agent with no binding to a credential
cannot request it, whatever else it can do.
3
It is delivered to a run
When a bound agent starts a run that needs the credential, the value is delivered to the worker
for that run.
4
The run ends and it is gone
The SDK holds a run’s credentials in memory for the run only and never persists them, so a
worker restart or a crash does not leave a secret on disk.
A binding can allow on-demand fetch, so the agent resolves the credential outside a run — for a
value it needs at startup, such as a boot-time token. An on-demand value is held in the worker’s
memory for the life of the process rather than delivered per run, and is still never written to
disk. When on-demand fetch is off, the credential is available only during a run.
What is masked on the way out
Any run-scoped secret is replaced with a redaction marker before anything leaves the worker — recursively, across event names, content, payloads, and metadata. A token echoed into a log line or returned inside a tool result does not reach the run record in the clear.This is a platform behavior, not a rule you configure. Configurable redaction — keeping a value out
of a specific tool call or model prompt — is a
guardrail, and it applies to values that
are not run-scoped secrets.
Rotation and revocation
Every one of these is recorded in the audit log:
creation, updates, value replacement, deletion, and binding changes.
Practical guidance
Keep a worker’s token out of source control: deliver it as an environment variable or a mounted secret, and rotate it from the console rather than editing it in place.Next steps
Credentials & secrets
Creating and binding a credential.
Data handling & redaction
What else is masked, and what is not.
Agent identity
The worker token, and how it is managed.
Audit log
The record of every credential change.