WORKSHOP · SECURITY · WS·01

The Secrets Workshop

How CEOs lose company secrets through AI agents — and the seven rules that stop it. Deep-dive companion to M7 OP3. 11 slides, 40 minutes.

11 SLIDES · ~35 MIN · PLAYBOOK OVERVIEW
Key Takeaways
  • Seed. Vault. Agent. Audit.
  • $10.22M — record-high average cost of a U.S. data breach in 2025, up 9% YoY — and AI agents are the new attack surface.
  • 22% — of breaches in the 2024 Verizon DBIR involved stolen credentials — the primary vector.
  • 292 days — average time to identify and contain a breach involving stolen credentials.
  • How many agents are running in production today? If you cannot get a number in five minutes, that is the answer.
WORKSHOP · SECURITY · DEEP-DIVE COMPANION TO M7 OP3

The Secrets Workshop

How CEOs lose company secrets through AI agents — and the seven rules that stop it. Deep-dive companion to M7 OP3.

BuildClub Academy
01 · WHY THIS MATTERS

The breach is already priced in.

$10.22M
record-high average cost of a U.S. data breach in 2025, up 9% YoY — and AI agents are the new attack surface.
IBM Cost of a Data Breach Report 2025
22%
of breaches in the 2024 Verizon DBIR involved stolen credentials — the primary vector.
Verizon DBIR 2024
292 days
average time to identify and contain a breach involving stolen credentials.
IBM Cost of a Data Breach Report
THE THESIS

Seed.
Vault.
Agent.
Audit.

The Thesis
02 · VOCABULARY

Five words that aren't interchangeable.

Password
What a human types. Rotatable. Phishable. Wrong unit of analysis for agents.
API key
A long string that authenticates a program. Often static, often over-scoped, often pasted into env files. The most common leak.
OAuth token
A scoped, time-limited grant. Better than an API key for most user-acting agents. Revocable per session.
Service account
An identity for a program, with its own credentials. Shared across many agents historically — which is the bug, not the feature.
Machine identity
An identity per agent, with scoped permissions and audit. The right unit for agent security in 2026.
03 · METHOD MATTERS

Method matters. The choice you make is the policy you live with.

Plaintext in env files
Common. Easy. Catastrophic. One leaked repo, one screenshot in Slack, the secret is in the wild forever.
Cloud-provider vault only
Better than env files. Still single-vendor lock-in. Still one root identity that, if compromised, holds everything.
Dedicated secret manager
1Password, Infisical, Vault. Vertical vaults, scoped identities, per-agent audit. The 2026 baseline.
Hardware-root + dedicated manager
Bootstrap key on hardware (YubiKey, HSM). Secret manager handles operational rotation. The blast radius is one human.

Move every workload at least one quadrant to the right.

04 · THE TRAP

How CEOs actually lose secrets — three traps.

01
The screenshot trap
CEO pastes a config into a chat to ask a question. The secret is in the screenshot. The screenshot is in the model provider's training data, the support ticket, and the colleague's downloads folder.
02
The shared-account trap
One service account, used by every agent. When something goes wrong, you cannot tell which agent did it. When the secret leaks, you cannot rotate without breaking all of them.
03
The convenience override
Someone needs to ship by Friday and grants an agent admin permissions "just for this week." The week never ends. The grant never gets revoked.
05 · THE PATTERN

The pattern: seed, vault, agent.

LAYER 1 LAYER 2 LAYER 3 SEED hardware root · never seen by an app provisions identities only VAULT EMAIL inbox · send scoped creds only VAULT CLOUD AWS · GCP scoped creds only VAULT BILLING Stripe · QBO scoped creds only VAULT CODE GitHub · npm scoped creds only AGENT · Sales one machine identity AGENT · DevOps one machine identity AGENT · Finance one machine identity AGENT · Build one machine identity One root. Domain vaults. One identity per agent. No agent ever sees the union — that is the entire policy.
Takeaways
  • 1 Seed — a single root identity, on hardware, used only to provision new identities. Never seen by an application.
  • 2 Vault — vertical scopes (email, cloud, billing, code). Each holds its domain's credentials and nothing else.
  • 3 Agent — one machine identity per agent, with read access to exactly the vault(s) it needs. No agent ever sees the union.
  • 4 Audit — every read of every secret writes a log line. Monthly review catches drift before an attacker does.
06 · ISOLATION

Isolation is the architecture. Discipline is the harness.

Production · Customer data
Own AWS / GCP / Azure account. Separate billing. Separate root credentials. Hardware MFA mandatory.
Staging · Synthetic data
Own account. No production credentials present. Agents tested here cannot touch real customer records, ever.
Experiments · Sandbox
Disposable. Built and destroyed daily. The right place to try unfamiliar agents — because failure is contained.
One account for everything
The default at most mid-market firms. One blown experiment can reach a customer record. Move off this corner.

Blast radius is an architecture choice, not a security feature.

07 · TOOLING

Two tools. Different jobs. Use both.

1
1Password — for humans
Personal credentials, shared team logins, MFA seeds, hardware-key backup codes. Humans use this every day. Agents do not.
2
Infisical (or Vault) — for agents
Programmatic secret manager with machine identities, scoped vaults, and audit logs. Agents authenticate as themselves; humans rarely touch this surface.
3
The combination
Humans → 1Password. Agents → Infisical. Bootstrap from 1Password into Infisical at provisioning time. Never the other way around.
08 · THE RULES

Seven rules that survive Friday at 5pm.

1
2
3
4
5
6
7
1
No secret in code, ever
Not in env files committed to repos. Not in CI variables visible to every job. Not in screenshots.
2
Bootstrap key on hardware
YubiKey or equivalent. The only credential that touches the laptop file system is the agent's scoped token — never the root key.
3
One identity per agent
If two agents share an identity, treat them as one agent for blast-radius math. Usually they should not share.
4
Vertical vaults, not horizontal
Vault per domain (email, cloud, billing, code). No vault contains the union of two domains.
5
Time-limited tokens by default
30 days max. Renewable by automation, not by a human pasting.
6
Monthly audit, calendar-locked
Last Friday of the month. Review identities, rotate keys, read the audit log. Treat it like board prep.
7
Document the policy in 200 words
If your security policy is longer than a page, nobody reads it. If nobody reads it, it is not a policy — it is theater.
CLOSING

Five questions to ask your CISO on Monday.

Monday Morning
  1. 1
    How many agents are running in production today? If you cannot get a number in five minutes, that is the answer.
  2. 2
    Where does the bootstrap key live? If the answer involves a laptop hard drive, escalate.
  3. 3
    How many vaults do we have? One is the wrong answer. So is twenty.
  4. 4
    When was the last identity audit? If the answer is "we'd have to check," schedule one this week.
  5. 5
    If our biggest agent's identity leaked tomorrow, what is the blast radius? If nobody can answer in 60 seconds, the radius is too large.
WS·01 · Questions CEOs Ask

Frequently Asked Questions

What is the core idea of The Secrets Workshop?
Seed. Vault. Agent. Audit.
What does the data say a CEO should pay attention to?
$10.22M record-high average cost of a U.S. data breach in 2025, up 9% YoY — and AI agents are the new attack surface. 22% of breaches in the 2024 Verizon DBIR involved stolen credentials — the primary vector.
What should a CEO do Monday morning after reading The Secrets Workshop?
Start here: How many agents are running in production today? If you cannot get a number in five minutes, that is the answer; Where does the bootstrap key live? If the answer involves a laptop hard drive, escalate; How many vaults do we have? One is the wrong answer. So is twenty.
What are the steps in The Secrets Workshop?
1) No secret in code, ever; 2) Bootstrap key on hardware; 3) One identity per agent; 4) Vertical vaults, not horizontal; 5) Time-limited tokens by default.
Where do the claims in The Secrets Workshop come from?
The playbook cites IBM Cost of a Data Breach Report 2025; Verizon Data Breach Investigations Report 2024; Infisical machine identity model; OWASP Agentic Security Initiative — over-permissioned identities.
WS·01 · Sources

All Sources in This Playbook

00 / 11