When building an enterprise AI agent, you will quickly hit a critical security dilemma:A user asks an agent to inspect a...

When building an enterprise AI agent, you will quickly hit a critical security dilemma:A user asks an agent to inspect a document in their cloud storage drive and update an issue in their project management tracker. To perform these tasks, the agent must call external APIs on behalf of that specific user.How do you give the agent the necessary authorization tokens to execute these actions?In early prototypes, developers often inject the user's raw Bearer token directly into the LLM system prompt or into the tool arguments.Putting raw credentials into an LLM prompt or tool argument is an unacceptable security hazard.If an attacker executes a prompt injection attack (such as hiding instructions inside a shared document that direct the model to output its system prompt), the model can leak the user's secret keys into the chat window. Furthermore, prompts and completions are logged across monitoring tools and vector caches, exposing sensitive credentials in plain text.To solve this, we arc...