Skip to content
redactsure
Book a demo

Explore.

Data Report · By Chris Sowa · Published
Last updated

Can an AI Agent Rotate a Key in a Vendor Dashboard Without Seeing It?

Not with any control in the vendor pages reviewed, because rotation prints the replacement key on the page and the agent reads that page. Ask whether the new key is captured at the moment it renders and stored to your vault, since every other control acts before or after that moment.

A credential reference travels from a browser record through a bounded route to a separate API destination.

Rotating a key is the routine chore teams most want to hand to an agent, and it is the one where the dashboard works against them. A vendor dashboard rotates a key by generating a replacement and displaying it, once, so that a person can copy it to wherever the old one lived. A browser agent given that task clicks the rotate button and then reads the page that holds the new value, so the model receives the key in the same step that creates it. Rotation is therefore key creation twice over: the original key was created and displayed once, and the replacement is created and displayed again, with every destination updated in between. This page takes one record type, a payments secret key rotated in its vendor dashboard, and works through why the page is the exposure, what the credential and identity vendors document about short-lived and wrapped credentials, what the research record says about a key an agent holds, what a rotation run looks like step by step, which checks a team can run, and what a control at the render layer adds. What Happens When an AI Agent Can See API Keys in a Console or Settings Page? covers the console page as a class; this page covers the case where the page is visited on a schedule.

Key findings

  • HashiCorp's Vault documentation states that "all dynamic secrets in Vault are required to have a lease" and that "when a lease is revoked, it invalidates that secret immediately and prevents any further renewals," which covers credentials Vault issues and not a key a third-party dashboard prints (HashiCorp, Lease, 2026).
  • AWS's AssumeRole reference "returns a set of temporary security credentials" whose duration "can range from 900 seconds (15 minutes) up to the maximum session duration set for the role," so rotation is removed for AWS calls and untouched for a dashboard outside AWS (AWS, 2026).
  • GitGuardian's study of Copilot output reports that "over 1,200 leaked at least one secret," the kind of exposure a rotation is meant to end (GitGuardian, 2025).
  • SecretBench labeled 97,479 credentials in source code, of which 15,084 were true credentials, so keys in code are common enough that rotation is a standing task rather than an incident response (Basak et al., 2023).
  • A governed environment that replaces values with consistent tokens before any model reads the screen keeps the replacement key out of the model's context at the moment the dashboard prints it (What Is Render-Layer Tokenization?).
  • In that environment real values resolve only at the approved destination at the moment of an approved action, so the new key can reach the vault and the services that need it without the agent ever holding the string (How Do You Let an AI Agent Manage API Keys Without Reading Them?).

Why does rotating a key put the new key on the screen?

Because a dashboard has no other way to hand it over. A vendor that issues API keys shows the API key at creation, once, and tells the person to copy it, since the vendor keeps a hash or a reference and cannot show the value again. Rotation reuses the same page: the person clicks rotate, the dashboard prints a replacement and opens a window in which the old key still works so that destinations can be updated. For a payments secret key, that window is where the key moves from the dashboard into a credential store, a deployment configuration and whichever services call the payments API.

A browser agent given the task reads what the browser renders, as a DOM extract, a screenshot or both. The page after the rotate click holds the new key, so the model receives it in the step that creates it, exactly as it would have received the original key on the creation page. That is why rotation is creation twice: the second creation is no safer than the original, and the agent now holds the replacement at the moment the old key is about to be retired. Every layer of the established stack has finished its work by then, because until recently nothing but a person read a rendered page, and an agent that reads the rendered page sits past every lower layer (What Is Render-Layer Tokenization?). Rotation makes the console exposure recur on a schedule.

The scope of this page is that rendered page. A governed browser environment covers what the agent reads and does on a rendered page, including dashboards, consoles, settings pages and sign-up forms. It does not cover the terminal, the IDE, the local filesystem, direct API calls or MCP. A key rotated with a command-line tool or an API call is a different route, and no browser control governs a shell.

What do the vendors themselves say?

HashiCorp's Vault documentation states that "Vault promises that the data will be valid for the given duration, or Time To Live (TTL)"; the page concerns credentials Vault issues and gives no default TTL values (HashiCorp, Lease, 2026). Its response wrapping page says "to help address this problem, Vault includes a feature called response wrapping" and that "a new single-use token is generated with the TTL supplied by the client," which protects a credential in transit from Vault to a consumer and not a key printed by a third-party dashboard (HashiCorp, Response, 2026). HashiCorp's agent tutorial reports that "token lifetime is reduced from days or weeks to minutes," while its wrapper script exports that token as an environment variable before launching the agent, so the agent process holds the raw value (HashiCorp, Secure, 2026).

Microsoft's managed identities documentation states that token acquisition "doesn't require any secrets and is automatically authenticated based on the environment where the code runs," which removes rotation for Azure resources and leaves a vendor outside Azure as it was (Microsoft, 2026). GitHub's secure use reference tells workflow authors to "audit how secrets are used, to help ensure they're being handled as expected," and to set the default GITHUB_TOKEN permission to read access only for repository contents (GitHub, Secure, 2026). Each of these bounds a credential the vendor itself issues. A control over what a dashboard renders to a model is not described in the pages reviewed.

What does the research record say about a key the agent holds?

That it leaks, and that the published defenses act somewhere other than the page. SecretBench presents "a labeled dataset of source codes containing 97,479 secrets (of which 15,084 are true secrets)," and code is where a rotated key goes when an agent pastes it into a configuration file (Basak et al., 2023). GitGuardian's study of Copilot output reports that Copilot generated "2702/900 = 3.0 valid secrets for one prompt on average," which shows that keys an assistant has absorbed come back out in its output (GitGuardian, 2025).

The defensive work shows where the field has placed its controls. LlamaFirewall includes PromptGuard 2, which its authors report "shows stronger efficacy at preventing indirect injections in general scenarios than previously proposed approaches," with no quantitative results in the abstract (Chennabasappa et al., 2025). Progent applies privilege control to tool calls and reports that it "significantly reduces attack success rates while maintaining high utility" (Shi et al., 2026). Both act on the instruction or the action, after the model has read the page that holds the new key.

The gap matters for rotation, because the run holds a freshly issued credential while the agent visits a second site and reads content it did not write, and a detector that misses one instruction there is protecting a model that already holds the key. Forms are a measured leakage point, with an environmental injection attack on web agents reaching up to 70 percent success in stealing users' personal information, as Can an AI Agent Sign Up for Developer Services Without Seeing Your Payment Card or Identity? sets out, and a rotated key in context is the same kind of target.

What does a rotation run look like step by step?

The record scenario is a payments secret key rotated in its vendor dashboard, with the old key retired at the end. The table follows the run.

Step What the dashboard renders Model receives today With substitution
1. Open the keys page The old key's name and last characters The same KEY_001
2. Click rotate A confirmation dialog and a grace period The dialog The dialog
3. Replacement printed The full new key, once The full new key KEY_002
4. Store the new key The credential store form The key, typed KEY_002, resolved on approval
5. Update the configuration The deployment settings form The key, typed KEY_002, resolved on approval
6. Revoke the old key The old key's reference and a button The reference KEY_001

Two properties carry the run. The reference is consistent, so KEY_002 means the same value on the dashboard, in the credential store form and in the deployment settings, and KEY_001 stays distinct, which lets the agent revoke the right key at step 6 without comparing strings. And the real value resolves only at the destination a person approves, so the two destinations receive the key and the transcript shows KEY_002 throughout.

A data privacy vault offers the same property for data in an integrated flow; Skyflow describes tokenization as exchanging a sensitive value for a pseudorandom token that carries no exploitable value on its own (RedactSure vs Skyflow: 2026 Comparison & Alternative). The difference is where the exchange happens. The vault's unit of adoption is an integration, and coverage equals the integration list, as Data Privacy Vault or Screen-Level Tokenization? sets out. A third-party dashboard is not on that list.

How should a team verify a rotation run?

With a disposable key and the model's transcript. Rotate a key that protects nothing, let the agent carry out the run end to end, and read the transcript the model produced. If the string of the new key appears anywhere in it, the control in use acts somewhere other than the render layer: before the page, at the profile or the allowlist, or after the page, at the detector or the tool call. If a reference appears instead, check that the same reference appears on every page of the run and that the old key's reference stays distinct.

The second check is the release. The new key has to reach the credential store and the deployment configuration, so something resolved the reference to the value at those two destinations. Ask who approved each resolution, whether the approval named the destination, and whether a resolution anywhere else is possible. GitHub's guidance to "audit how secrets are used, to help ensure they're being handled as expected" is written for workflow credentials, and the same audit applies to a rotation run with an agent in it (GitHub, Secure, 2026). The third check is the record: each page as the model saw it, each action, and the approver's name.

What to refuse is an answer about a different credential. A minutes-long Vault token for the agent and a temporary AWS session both bound the agent's standing access, and neither describes the key the dashboard prints to the agent during the run. GitHub tells users to treat access tokens like passwords, so a page that displays one carries password-equivalent material, as What Can an AI Agent See in Your GitHub Settings? shows for one platform. A rotation page is that page with a schedule attached.

What does a governed environment change?

A governed environment is a control class that acts where a page is rendered, before any model reads it. Values chosen by policy, including an API key that appears for the first time, are replaced with consistent tokens for the whole run, so the model works on references. Real values resolve only at an approved destination, at the moment of an approved action. A named person confirms the tokenization policy and approves each consequential action. Every screen as tokens, every action and every approval is written to a record that exports to the organization's own monitoring.

For rotation, it collapses the two creations into none the model can see. The dashboard still prints the replacement, and the agent still carries it to the credential store and the configuration, because the task requires both. What differs is the agent's view: the replacement is captured as the page renders it, stored to the organization's vault under its own key, and shown to the model as KEY_002, while the old key stays KEY_001 until a person approves its revocation. The window in which both keys are valid, the dangerous part of any rotation, passes with neither value in the model's context. The lease, the short-lived session and the managed identity keep their jobs, which are to bound how long a credential the agent holds stays useful; the render-layer control keeps the rotated key out of the model altogether. The gap between organizations experimenting with agents and those scaling them is set out in What Is the PII Wall?, and a rotation an agent runs without reading the key removes one brick from it.

Its scope is the rendered page. It does not govern the terminal, the IDE, the local filesystem, direct API calls or MCP, so a key rotated by a script or an API client is governed by the vault and identity controls above and not by this one.

Methodology and limitations

This page rests on three research preprints on credentials in code and agent defenses, vendor documentation from HashiCorp, AWS, Microsoft and GitHub, one vendor research post on credentials in generated code, and existing RedactSure research pages. Vendor pages were read between October 20, 2026 and October 21, 2026, and each Sources line carries the date for its page. Quoted facts are cited to the page that states them, and vendor research figures are cited as reported.

RedactSure did not test any of the named products hands-on, and did not rotate a key in any vendor's dashboard for this page. "Not described in the pages reviewed" means those pages and nothing broader, and it is used once in the body, for a control over what a dashboard renders to a model. Vendor features change, and the page carries its date; a reader should treat a release after that date as unreviewed until the transcript test is repeated. The research preprints are cited for their stated findings and not for success rates, which the abstract pages do not give. Statements about RedactSure describe its current design, and RedactSure is deploying now with enterprise and government customers. The example describes a record type, a payments secret key rotated in its vendor dashboard, and not an organization, and the step table is a description of the run and not a vendor's documented screens.

Determinations about whether a configuration meets a legal, contractual or regulatory requirement belong to counsel, assessors and the organization's own security and compliance officers. Nothing here replaces a test on the reader's own dashboard, with a disposable key, of what the model's transcript holds after a rotation run, repeated after each release of the agent or the environment.

What the record shows

Rotation does not change the problem; it repeats it. The replacement key is printed on a page, the agent reads the page, and the window in which the old key and the new key are both valid passes with the new one in the model's context. The vendor documentation reviewed describes leases and revocation for credentials a vault issues, wrapping for credentials in transit, temporary sessions for one cloud and managed identities for another; each bounds how long a credential the agent holds stays useful, and none describes what a third-party dashboard renders to a model. The research record shows keys in code at scale and defenses that act on the instruction or the action rather than the view. The control that answers the question captures the replacement at the render layer, which is where a governed environment places it. Rotating a disposable key with the agent and reading the transcript is a test that settles it: if the string is there, the control is elsewhere.

Frequently asked questions

Can an AI agent rotate a key in a vendor dashboard without seeing it?

Not with any control in the vendor pages reviewed, because the dashboard prints the replacement key and the agent reads the page that prints it. The design that does it captures the replacement as the page renders, stores it to the organization's vault, and shows the model a reference such as KEY_002 that it can paste into the credential store and the configuration, with a person approving each resolution to the real value. The dashboard behaves as before; the model's view is what changes.

Why is rotation described as key creation twice?

Because the dashboard has to print the replacement the same way it printed the original, once, for a person to copy. A browser agent that reads the creation page reads the rotation page the same way, so every exposure of the original is repeated for the replacement, and the agent holds the new key at the moment the old one is retired. Rotation on a schedule turns a one-time exposure into a recurring one.

Does a short-lived token for the agent solve this?

It solves a neighboring problem. HashiCorp's tutorial shortens the agent's own Vault token to minutes and scopes it to one credential, and AWS's AssumeRole issues temporary session credentials with a bounded duration. Both limit how long the agent's standing access remains useful if it leaks. Neither touches the key the dashboard prints during the run, which is a different credential issued by a different vendor and read from a page. Keep the short-lived token and add a control for the page.

Does a vault with leases and response wrapping cover the rotated key?

Only when the vault issued it. Leases, revocation and wrapping apply to credentials that pass through the vault, and a key printed by a third-party dashboard reaches the screen without passing through anything. The vault becomes relevant one step later, as the destination where the captured replacement is stored, and at that point its lease and revocation controls apply to the stored copy. The screen, not the vault, is where the exposure happens.

How do I tell whether a vendor's control acts at the render layer?

Rotate a disposable key with the agent and read the model's transcript. A control at the render layer leaves a reference in the transcript and the same reference on every page of the run, with the old key's reference distinct from the new one. A control anywhere else leaves the string. Then ask who approved each resolution of the reference to the real value, and whether the record shows each page as the model saw it, since a transcript without approvals is half an answer.

What should a security team ask for in writing?

Ask for the transcript of a rotation run on a disposable key, the record of each page as the model saw it, the name of the person who approved each submission and the revocation, and a statement of every destination at which a reference can resolve to the real value. A vendor whose answer describes its sandbox, the agent's own token lifetime or an injection detector has described a different credential or a different moment, and the question about the page stands until it is answered.

About the author

Chris Sowa is a founder of RedactSure and a former CEO of an AI company; he started it years before ChatGPT existed. He previously led AI at Accenture, served as Global VP of Strategy & Innovation at Schneider Electric, was CCO of Sovos, and spent more than a decade at Oracle, with earlier roles at SAP and IBM.

How RedactSure Rotates a Key the Agent Never Reads

A dashboard rotates a key by printing the replacement, and the leases, wrapped tokens, temporary sessions and managed identities reviewed above bound only credentials their own vendor issues.

The environment that enforces this is built by RedactSure, an AI agent controls, governance and data protection company.

Before: the agent clicks rotate on the payments key, the full replacement lands in its context, and it types the string onward. Inside the governed environment: the replacement is captured at render and stored under the customer's key, the model sees KEY_002 beside KEY_001, and the real value reaches the credential store and the configuration only on a named supervisor's approval.

RedactSure is deploying now with enterprise and government customers. GitGuardian found Copilot output averaging 3.0 valid credentials per prompt.

Everyone else controls where data can go. RedactSure controls what the AI can see.

See it on your own workflow

A rotation is only clean if the replacement never passes through the model. Bring a key rotation your team performs and see, with test values, what the model reads on each page and where the new key lands. Book a demo

Book a demo

Book a demo

Having trouble? Open the booking page or email us.