Credential Airlock vs. environment variables
Environment variables are the default because they're easy — and for AI agents they're the problem: anything the agent's process can read, the agent can reason about, log, or be tricked into repeating. A credential firewall inverts the model: the agent only ever holds dummy keys, and a local deny-by-default proxy injects real credentials at the network boundary, only for allow-listed hosts, with every request audited. One is a convention; the other is a boundary.
The default way most agent setups hold API keys today. Competitor details are summarized from public materials as of Aug 18, 2026 — verify current specifics with the vendor.
One point per dimension below. Where Environment variables is genuinely the better answer, it takes the point — a comparison that never loses is a comparison nobody should trust.
| Dimension | Credential Airlock | Environment variables |
|---|---|---|
| Can the agent read the real key? | No — it only ever sees dummy values — wins this dimension | Yes — it's in the process environment |
| Prompt-injection blast radius | Capped: nothing real to leak; unknown hosts denied — wins this dimension | Full key compromise is possible |
| Destination control | Deny-by-default allow-list per host — wins this dimension | None — the key works anywhere |
| Audit trail | Every request logged — wins this dimension | None by default |
| Setup cost | Install and route agent traffic through the local proxy | Zero — wins this dimension |
- Your agent browses, reads untrusted content, or runs semi-autonomously
- A leaked key would actually hurt (billing, data, production)
- You want an audit trail of every credentialed request
- Short-lived, throwaway keys in a sandbox where a leak costs nothing