Multi-Agent Systems & Least Privilege

When orchestrating multiple AI agents (e.g., a Researcher, a Writer, and a Reviewer) in frameworks like CrewAI, AutoGen, or LangGraph, managing credentials becomes a major security challenge.

If you inject secrets via standard environment variables, every agent has access to every secret, completely violating the principle of least privilege. A compromised or prompt-injected Writer agent could steal production database keys or search API tokens.

AgentSecrets solves this with Agent Identity & Capabilities.

1Register the Agents

agentsecrets agents register researcher
agentsecrets agents register writer

2Configure Capability Policies

Restrict which secrets each agent identity can resolve at the proxy boundary:

# Allow researcher to access SEARCH_API_KEY
agentsecrets agents policy set researcher --allow SEARCH_API_KEY

# Deny writer from accessing SEARCH_API_KEY
agentsecrets agents policy set writer --deny SEARCH_API_KEY

3Issue Tokens (Saved to OS Keychain)

Issue cryptographic tokens for each agent. When prompted, save them to your local OS Keychain:

agentsecrets agents token issue researcher
agentsecrets agents token issue writer

4Use Keychain Token References in Python (Recommended)

Instead of hardcoding raw token strings in your codebase or .env files, pass the Keychain Token Reference (AGENTNAME_TOKEN, case-insensitive). The AgentSecrets proxy automatically resolves the real token securely from your OS Keychain at runtime:

from agentsecrets import AgentSecrets

# 1. Researcher agent resolves token from OS Keychain
with AgentSecrets(agent_token="RESEARCHER_TOKEN") as researcher_client:
    # Allowed: Researcher capability policy permits SEARCH_API_KEY
    response = researcher_client.call(
        "https://api.search.com/v1/query",
        bearer="SEARCH_API_KEY"
    )
    print("Search results:", response.json())

# 2. Writer agent resolves token from OS Keychain
with AgentSecrets(agent_token="WRITER_TOKEN") as writer_client:
    # BLOCKED with 403 Forbidden:
    # The proxy blocks this request because the Writer policy denies SEARCH_API_KEY
    try:
        writer_client.call(
            "https://api.search.com/v1/query",
            bearer="SEARCH_API_KEY"
        )
    except Exception as e:
        print("Blocked by AgentSecrets:", e)

5Alternative: Programmatic Management with Module

You can also manage and invoke agents programmatically using the agent module in the Python SDK:

from agentsecrets import agent

# Retrieve configured agent identities
researcher = agent.get("researcher")
writer = agent.get("writer")

# Scoped execution — the SDK attaches the agent identity automatically
researcher_response = researcher.call(
    "https://api.search.com/v1/query",
    bearer="SEARCH_API_KEY"
)

Summary of Protection

Zero Hardcoded Tokens: Application code only contains RESEARCHER_TOKEN and WRITER_TOKEN references.
Least Privilege Enforcement: Each agent is restricted to only the credentials it needs to perform its job.
Tamper-Proof Audit Trail: Every API request in agentsecrets logs is stamped with the verified agent identity for compliance and forensics.