What is a Secrets Management?

The core principle is that secrets should never live in source code, config files committed to version control, or plaintext environment files where they're easily leaked; instead they belong in a dedicated secret store (a vault, a secrets manager, an encrypted database field) with access controlled and audited separately from the application code that uses them. Applications retrieve secrets at runtime through an authenticated call to the store rather than reading them from a file baked into a deployment. Good secrets management also handles the full lifecycle: rotation (periodically replacing a secret so a leaked one has limited value), scoped access (a service gets only the secrets it needs, not the whole vault), and revocation (immediately invalidating a compromised credential). Encryption at rest with a distinct key from other application data, and backward-compatible key rotation with a versioning scheme, are standard requirements in security frameworks like SOC 2 and ISO 27001. For AI agent platforms specifically, secrets management extends to third-party OAuth tokens the agent needs to act on a user's behalf (a connected Gmail or Slack account) — those tokens are as sensitive as passwords and need the same encrypted-storage, least-privilege, and rotation discipline.