Analysis
From API Keys to Access Control: Rethinking Secrets Management
Publication date not yet evaluated · Added postman.com
Page published
Coverage timeline
Single-source analysis — one report is available.
Why it matters
Agentic systems expand the credential attack surface by letting autonomous agents and their spawned processes inherit and misuse secrets at runtime, a risk defenders must account for when granting AI agents access to API keys and tokens.
A Postman blog post argues that traditional secrets management (hard-coded keys, env vars, centralized vaults) all rely on the caller holding the plaintext secret at request time, an assumption that becomes dangerous with agentic development. It notes that AI agents decide at runtime which tools and hosts to call, and spawned processes inherit environment-variable credentials the agent may not need, exposing keys to code the developer did not write and endpoints they did not choose.