How would you keep secrets and credentials out of model context?

I threat-model secret exposure through debugging, retries, exception capture, screenshots, generated support bundles, provider retention, and model-written code. Egress controls prevent a compromised workflow from forwarding credentials even if another component leaks one. Credential issuance is bound to the validated operation, resource, actor, audience, and short expiry so captured authority has limited reuse. Incident response can revoke affected identities and find every run that used them without searching sensitive prompt bodies.