In my little agent platform every coding agent is a Kubernetes Job: it gets a repository, a task and a deadline, works, pushes a branch and opens a pull request. Which means every one of those Jobs has to authenticate against Forgejo, our Git host - and my first version of that was exactly the thing you'd expect: a Personal Access Token per agent, sitting in a SealedSecret next to the agent definition.

It worked. I still didn't like it, and the reasons were never "it's a secret in Git", because it wasn't a secret in Git - it was sealed. The reasons were:

The credential outlives the work. An agent run lasts two hours. The token lasts until somebody remembers to revoke it.

It is a shared identity, not a per-run one. Anybody who can create a Job can mount the SealedSecret. That includes a fellow agent, and it means "who pushed this?" has exactly one answer for the whole platform.

It is a value somewhere. In a pod spec, in env , in a crash dump, in a diff of a debug session.…