Rotation feels like the fix
A leaked key is the visible problem. It has a name, a blast radius, a clean before-and-after — rotate it and the sense of danger leaves with it.
That's the trap. The feeling attaches to the wrong target — the real risk lives somewhere the rotation habit never looks.
Five secrets. Then forty.
Six months ago the count was small enough to hold in memory: about five secrets — a provider key, a payments key, a code-hosting login. It was a solo setup, a couple of apps, not much more.
Now it's past forty. The kinds multiplied along with the count: provider keys, then signing keys, deploy keys, database credentials, OAuth pairs, CI tokens, webhook secrets. The six-to-twelve-month forecast — a moving estimate, not a settled number — puts the surface somewhere between seventy and two hundred, depending on how much gets built out from here.
Every new capability doesn't cost one credential. It costs a category.
New citizens showed up
The identity model had three kinds of "who": a machine, a person, sometimes a role. Every credential belonged to one of the three.
Agents are a fourth kind. As fleets of them take on real work, the access principal becomes the agent itself — not the machine running it, not the person who deployed it. Per-agent, capability-limited, expiring credentials are the direction that has to go; most of what's already built was never designed around an agent as its own principal.
The one that gets you
The real risk at scale isn't the leaked key. It's the key nobody remembers exists.
A leaked key announces itself eventually — a scan catches it, something looks wrong, someone asks a question. An unknown key never announces anything. It just sits there, valid, attached to nothing anyone is tracking, until it's found by whoever is looking harder.
Rotation discipline is real, but it fails silently: you can rotate every key you know about, on schedule, forever, and that practice says nothing about the keys you don't know about. The gap doesn't show up as a failed test. It shows up as an absence, and absences don't page anyone.
Making "accounted for" a fact, not a hope
Completeness closes the gap, and it works as an engineering property, not a discipline problem.
"Everything that exists is in the manifest" can be made mechanically true: wire secret-scanning into the pipeline so nothing new can exist outside the list, and the list stops being a hope and becomes a fact the system enforces.
A secret outside that list hasn't stopped being real. It's stopped being defendable — which, until it's found, is functionally the same as not existing at all.
Fewer secrets beat a bigger vault
The instinct, when the count climbs, is to build a better vault: bigger, more organized, tighter rotation. But a bigger vault is still a bigger pile of things that can be forgotten.
The better direction is fewer secrets in the first place — federated identity where it's possible, short-lived workload tokens that expire before anyone could misuse them, instead of long-lived credentials sitting in storage waiting to be used or forgotten.
The goal isn't a vault good enough to hold two hundred secrets safely. It's an architecture that never needed two hundred to begin with. Fewer things existing beats more things guarded.
Every tool an agent touches is holding your session
The agent layer makes this sharper, not softer. An outside tool an agent can reach isn't just an API call — it's code executing with the same access as whoever granted it, like a browser extension with session access. It can act with that access, and it's not always visible what it's doing with it.
That's not a separate risk file. It's the same problem wearing a different hat: a capability granted and then not tracked closely enough.
The practices that follow: assume any connected tool could be compromised, pin versions instead of floating on the latest release, put a policy-enforcing layer in the middle instead of trusting good behavior by default, and keep a human in the loop with a real preview before anything destructive fires.
None of that is exotic. It's refusing to extend trust further than there's visibility to back it up.
What isn't settled yet
The numbers above are a forecast, not a settled account — meant to be revisited and corrected as the build-out happens, not treated as fixed. Whether the manifest approach stays workable as the count climbs toward the higher end of that range, or completeness holds only up to a point and no further, is still open.
