The build took six weeks. The review has taken five months, and it will not end in a no. It will end the way the last four ended, with a question nobody in the room can answer: what happens to that credential when the agent does something none of us predicted?
Nobody is being obstructive. The question is sound, and it is the reason the meeting keeps recurring.
What the reviewer is actually refusing
Not the model, and not the use case. They are refusing to place a working credential inside something whose behavior cannot be enumerated in advance. No amount of prompt discipline answers that, because it is not an argument about prompts. It is an argument about where the value sits.
So remove the subject of the sentence. Your applications, and the agents acting through them, carry a stand-in. The real value is substituted at the moment the call is dispatched, from your enterprise vault or from the owner's phone, and what returns to the application is the result.
What changes on your schedule
- The review question loses its subject. There is no working credential in the application, so "what if the agent misuses it" has nothing to attach to.
- Sign-off moves to the action. The conversation becomes which calls are allowed, a decision your risk owners already know how to make, and can make once for many projects.
- Rotation stops being a program. Nothing was holding a credential, so nothing has to be redeployed when one changes, and no launch waits on a rotation window.
- Vendor access stops accruing. Access is granted for an action rather than issued to a system and forgotten for two years, which is the question your renewal questionnaire keeps asking.
The questions review asks
| The question in review | The answer |
|---|---|
| Where does the agent keep the credential? | It does not have one |
| What if it leaks the value into a prompt or a log? | What it holds is not accepted anywhere |
| Who approved this vendor's access, and when does it end? | It ends with the action, on record |
| How do we revoke it in a hurry? | Change the policy. Nothing to redeploy |
| Can it act for a named person? | Without ever holding what that person holds |
What it does not settle
Whether the agent should be doing the work at all. That is a judgement about the action, and it belongs to the same people. It is simply a shorter conversation once the credential is out of it. A secret your own code keeps for its own purposes is untouched.
Where to start
Take the project that has been in review longest. Move its credential out of the application, and put the same design in front of the same reviewer with the objection removed. That meeting is short.
The mechanism, and the five ways a value can reach a call, are in Take the credential out of the application entirely.