Secrets discipline is a prerequisite for agent fleets, not an afterthought
Agent fleets multiply the secrets surface area by orders of magnitude. A single agent might need database credentials, API keys, and OAuth tokens. A fleet of hundreds — each serving multiple tenants, each with per-session isolation — needs a secrets infrastructure that can generate dynamic credentials on demand, rotate them automatically, and audit every access. This isn't a security feature you add after the fleet works. It's the prerequisite that makes the fleet operable.
Vault's architecture maps almost directly onto what agent fleets need. The dynamic secret pattern — generate-on-demand, unique per requester, TTL-bound, auto-revoke — is exactly what multi-tenant agent runtimes require. When an agent session starts, it should receive credentials that didn't exist before it requested them and won't exist after it terminates. Vault's database secrets engine demonstrates this: the creation_statements template generates a unique username and password, binds them to a role with specific permissions, and schedules automatic revocation. The agent never sees a static credential; it sees a lease.
The confused deputy problem in agent fleets
Multi-tenant agent platforms face the confused deputy problem: an agent acting on behalf of tenant A must not be able to access tenant B's resources, even if both tenants use the same underlying database or API. Vault's identity-based access model solves this with token exchange and namespace-scoped policies. The agent authenticates with its own identity, then requests credentials scoped to the tenant it's currently serving. The policy enforces the boundary — the agent can't accidentally or maliciously cross it because the credentials it holds don't grant that permission.
OAuth 2.0 token exchange (RFC 8693) extends this pattern to delegated authority. When an agent needs to act "on behalf of" a user, it exchanges its own token for a downscoped token that carries the user's permissions. The audit trail then shows not just that the agent accessed a resource, but which user's authority it was exercising. This is the foundation of agent auditability: who did what, on whose behalf, with what authority.
What "secrets discipline" means in practice
For agent fleets, secrets discipline means: (1) no static credentials in agent code or configuration — everything dynamic, everything leased; (2) per-tenant namespace isolation — tenant A's agent can't even enumerate tenant B's secrets; (3) automatic rotation — credentials expire on a schedule the agent doesn't control; (4) audit logging — every secret access is logged with the agent's identity, the tenant context, and the action taken.
The Kubernetes integration pattern is instructive. Pods authenticate via service account JWTs, which Vault validates against the Kubernetes TokenReview API. The pod never stores a Vault token; it presents its Kubernetes identity, and Vault mints a Vault token scoped to that identity's policies. For agent fleets, this means each agent deployment authenticates as itself, then requests tenant-scoped credentials dynamically. The agent's code is identical across tenants; the credentials it receives are what enforce the boundary.
The alternative is unoperable
Without this discipline, agent fleets accumulate secrets debt: static credentials embedded in configurations, shared across tenants, never rotated, impossible to audit. When a credential leaks, you can't rotate it without breaking every tenant. When you need to investigate an incident, you can't tell which agent accessed what. The fleet becomes unoperable at scale — not because the agents don't work, but because you can't trust them.
One concession: Vault isn't the only answer. Cloud-native alternatives — AWS Secrets Manager with IAM roles, GCP Secret Manager with workload identity — provide similar dynamic secret patterns. But the pattern matters more than the tool. If your agent fleet doesn't have dynamic, per-tenant, auditable secrets from day one, you're building technical debt that will require a ground-up rewrite to fix.