Environment variables, mounted secrets files, and runtime-injected tokens all share one flaw: the agent process can read them, and anything an agent can read it can leak — into a log, into a model response, or into an attacker’s hands via prompt injection. The fix is architectural, not procedural: never put the credential where the agent can reach it.
Register your database connection string once with a proxy that holds it encrypted at rest. The agent receives only a scoped API key that is useless outside the proxy — it cannot be replayed against your database directly, because it is not a database credential.
Rotating or time-boxing a database credential shrinks the window of exposure but does not close it: during that window the agent still holds something that opens your database. A proxy-issued key is a different class of secret. Even if it leaks, the holder still faces SELECT-only AST validation, the agent’s row-level security policy, and an append-only audit log.
You can revoke or rotate one agent’s key without touching your database credentials or any other agent.
A secure SQL proxy for AI agents: natural language in, SELECT-only validated SQL out, per-agent row-level security, and an append-only audit log. Your agents never see connection strings.