What is a secret reference?
A secret reference is an opaque identifier standing in for a credential stored elsewhere — typically a secrets manager. Systems pass the reference around; only the component that must actually authenticate resolves it.
The security property is narrow but valuable: components that never resolve the reference cannot leak the secret, because they never hold it. A configuration database full of references is far less interesting to an attacker than one full of keys.
It also makes rotation a single-writer operation. Update the vault, and every reference keeps working.
There is no field anywhere in the product that accepts a credential value. References are validated against a strict pattern and resolved only in the execution layer.
Related terms
- Connection — The binding between a reviewed action and a specific account on the provider, carrying a reference to a stored credential.
- Service account — A non-human identity used by software to authenticate, carrying only the permissions it was granted.
- JWKS — A JSON document publishing the public keys a party uses to sign tokens, so verifiers can validate signatures without shared secrets.
See it working rather than described.
The product demo runs one agent across three systems and stops at the approval gate.