credential-and-env-injection

Use a credential_ref enum bound to a manifest in the tool schema instead of free-text secret fields. Middleware validates the ref and hard-fails on unknown values, while a broker outside the sandbox resolves the actual secret server-side so it never enters the model's context.

Environment variables are readable by the agent itself through env, printenv, /proc/self/environ, or subprocess inheritance, and shell access is a first-class tool in these runtimes. They remain appropriate only for non-secret configuration and references to broker identity material.

Model-plane credentials access the upstream LLM and leaks cost money, while resource-plane credentials access customer databases and APIs where leaks cause irreversible data loss. The model plane centralizes per tenant; the resource plane must fragment to per-tool or per-call short-lived credentials.

Enforce default-deny egress at a mandatory proxy outside the sandbox, allowlisting by host and port with pinned addresses, denying DNS and loopback. The sandbox's only reachable address should be the proxy, so a co-located database is unreachable rather than merely filtered.

Redact at the tool-response serialization seam, before values enter the model context, compaction, or persistence. Once a secret reaches the context window it propagates to traces, prompt caches, and summaries, making downstream cleanup only best-effort.

Static analysis can derive read-versus-write behavior, table footprints, and declarative authorization annotations, but not data ownership, business destructiveness, or reversibility. Tools with underivable authorization must emit authorization: UNRESOLVED and stay disabled until a human binds a scope.