Coding agents call the processor's API without ever holding its key.
An agent works with a pass. When it calls an API the pass allows, the boundary attaches the key as the request leaves your network.
Agents pull .env files into their context, and commits made with Claude Code leaked secrets at 3.2%, against a 1.5% baseline, in GitGuardian's 2026 count.
The model reads the agent's task and proposes the pass. One of your approvers signs it, and a pass to a live API needs the CTO.
- What the agent holds: a pass that ends at 18:00
- What it never holds: the key itself
It writes only what a signed plan names.
The agent reads across your systems for the model. Writes happen inside an approved rotation and nowhere else.
Code hosts
every commit read, nothing written
CI logs
two years read, nothing written
Chat and tickets
channels and spaces you choose, read only
Clusters
manifests read; approved Secrets written
Infrastructure state
Terraform state read, never written
Your scanner's export
TruffleHog, GitGuardian, GitHub alerts
Your security team will want to see what an agent did with a key it never held.
For each request: the time, the agent and its pass, the API and what it asked for in a line the model writes, whether a key was attached, and whose approval it ran under.
The boundary's log in the example: 11:20 refunds list, key added, allowed; 11:22 card lookup, allowed; 11:31 live API, not in the pass, refused.
A request outside the pass is refused, logged and sent to the approver. In the example, the agent tried the live API at 11:31.
Test API request bodies are kept 30 days. Live payment API bodies never are, only their size and fingerprint, since they can carry card data.