Credential Mediation
Credential mediation is an architectural pattern in which AI agents never see or hold real authentication tokens. Instead, a gateway or proxy injects credentials into outbound requests at the moment of execution. The agent holds only an opaque, session-scoped identifier that has no value outside the gateway.
Why It Matters
AI agents are vulnerable to prompt injection: adversarial inputs that manipulate the agent into performing unintended actions. If an agent holds real credentials, a successful prompt injection can exfiltrate those credentials to an attacker.
Credential mediation eliminates this attack surface. Because the agent never possesses real tokens, a compromised agent context cannot leak credentials. The gateway reads the real credentials from the organization's vault at runtime, injects them into the outbound request, and strips them from the response before it reaches the agent.
This is the structural mitigation for credential theft in agent architectures. It does not depend on the agent platform's security, the downstream app's protections, or the user's vigilance. The credential simply never exists in a context the agent can access.