Short-Lived Keys for Long-Running Agents : Zero-Trust Access for AI Assistants

Abstract

An AI assistant that can read mail, call APIs and move money is only as safe as the credentials it carries, and credentials leak: through logs, through prompts, through a compromised plugin. This paper asks what an assistant should hold so that a leak costs as little as possible, and what that costs to run. We compare five designs: a static key, an eight-hour session token, short-lived tokens scoped to one tool, scoped tokens bound to the agent’s own key, and one-time tokens bound to a single action. We prove that the expected exposure from a theft is E[min(R, D)], where R is the token’s remaining life and D the time to detect the misuse, give it in closed form, and show that the cost-optimal lifetime is bounded below by 2b/a. In a simulation of credential theft, the expected loss per theft was about 294,175 units for a static key, 2,732 for a session token, 115 for a 15-minute scoped token, 11.4 when that token was also bound to the agent’s key, and 0.8 for one-time tokens. Over 99.4% of the static key’s loss came from thefts that were never detected, which is the real argument for expiry: it caps the damage when detection fails. We also built a prototype of attenable, HMAC-chained capability tokens with proof of possession and ran 18 security tests of 1,000 trials each. All behaved as designed, including one that shows the limit of the approach: a stolen bearer token works until it expires. Verifying a token took about 10 µs, or about 167 µs with proof of possession. All loss figures are simulated under stated assumptions.