Credential injection keeps a secret in a trusted service and adds the required authorization only when an approved request is sent. The agent can request access to a permitted destination without reading or copying the raw token.
The control is effective only when request targets, methods and scopes are restricted. Logs should avoid secret values, and the injecting service must reject attempts to redirect credentials to an unapproved domain.
ELI5
Credential injection is like having a trusted gatekeeper stamp an approved request without handing over the master key. The agent can use the permission but cannot read the secret itself.
For example, a network proxy can add an authorization token only when an agent contacts an allowed service. A request to another domain receives no token and should be blocked.
