A trusted component holds a credential and attaches it only when an allowed request is executed. The agent can ask for a bounded operation without receiving a reusable copy of the raw secret.
The boundary must validate destination, operation and scope so a request cannot redirect the credential elsewhere. Protecting the secret does not automatically authorize every action or make untrusted input safe.
ELI5
Credential injection is like having a trusted gatekeeper stamp an approved request without handing over the master key. The agent can use the permission but cannot read the secret itself.
For example, a network proxy can add an authorization token only when an agent contacts an allowed service. A request to another domain receives no token and should be blocked.
Does this remove the need for permissions?
No. The broker must still enforce which destinations and operations are authorized.
Why keep raw credentials away from the agent?
It reduces the opportunity for an agent or untrusted content to expose or reuse a secret beyond the intended operation.
