This is the cleanest take on the problem I've seen. Most advice stops at "don't paste secrets into the agent", which ignores how agents actually work — they need to make real API calls to do anything useful. Injecting short-lived credentials as env vars per invocation feels like the right granularity, and I'm glad you called out the redaction-in-prompt issue: once a credential value is visible in context, the transcript leak is already baked in. Curious how it handles tools that echo config back in their output — that feels like the next leak vector worth covering.