Agents can request secrets only when they need them

Secret access in Paperclip v2026.722.0 lets agents request approved secrets through an API. The secret does not have to remain in the environment for the full run, and Paperclip logs each request.

Environment variables work well when an agent needs the same secret on every run. But the value remains available for the full run, even when the agent does not use it. Environment injection also does not record when the agent reads the value.

Teams can choose how each secret reaches each agent and review on-demand requests in the company audit trail.

How secret access works

Secret access is available for agents in Paperclip v2026.722.0. It has three parts.

1. Choose which secrets the agent can request. Open the agent’s settings and add each permitted secret under Secret access.
2. Let the agent request a value when it needs one. During a run, the agent can list permitted secret names and request one value through the API; temporary review and skill-test sessions cannot request values.
3. Review each request. Paperclip records every request in the security audit trail and the operator activity log.

Choose which secrets an agent can request and how Paperclip delivers each one.

Choose when the secret is available

Use an environment variable when the agent needs the secret on every run.

Use on-demand access when the agent needs the secret only for a specific task. This keeps the value out of every run that does not need it, and it gives you a record each time the agent requests the value.

Getting started

Open an agent’s settings, select Secret access, and choose one secret the agent can request.

Find an agent by name when the same secret goes to more than one agent.

Teams can now keep always-needed secrets in the environment and request occasional secrets only when the work requires them. The secret-access documentation covers both delivery methods and the API.