Short-Lived Credentials in Agentic Systems: A Practical Trade-off Guide

This blog post argues that short-lived credentials should be the default for agentic AI systems, explaining how TTL should be tied to agent behavior, privilege, and execution model. It gives practical TTL guidance for interactive, background, and long-running agents; highlights operational difficulties (token issuance, refresh, vaults, developer experience, and third-party limitations); recommends brokered/vaulted dynamic issuance and per-task credentials to reduce blast radius; and positions continuous secret monitoring (GitGuardian) as essential to detect leaks, exceptions, and migration progress.