You paste an API key into your agent. One line in a .env file. It works right away.
But that key is yours. Your access, your reach, your name on every call.
You just handed your identity to a piece of software that writes its own commands.
An agent is not you. It is a new actor on your system. It needs its own.
TL;DR: a static API key in an agent is your identity, on loan. Broad, no end date, shared, impossible to trace. An AI agent is a non-human identity, an actor in its own right. Give it its own: a short-lived token, scoped to its need, revocable, and traceable in the logs. The industry has a name for the target, workload identity, like SPIFFE. Not a shared secret sitting in a .env.
