A tool needs credentials to call another system. The model generally needs the operation's contract, not the credential itself.
Place the boundary
A controlled service holds the credential and exposes a limited action. Tie requests to the authorized user and task. Keep unnecessary sensitive data out of tool results.
Verify misuse cases
Try an out-of-scope identifier and unexpected parameters. Server checks reject disallowed operations. Review diagnostic traces for accidental disclosure.
Accept implementation evidence
Ask the supplier where credentials live and how they are rotated. OWASP describes risks in LLM applications. Permissions should be demonstrated through actual denied calls, rather than inferred from instructions telling the agent to behave responsibly.
Related reading : An AI agent for internal knowledge: finish with evidence, not a guessed answer. Discuss your project scope with Sky Vaults.