Keeping API keys out of our AI agent's sandbox, and what that doesn't solve

Doozy runs each task in a fresh sandbox holding only a signed, short-lived job token, and a credential gateway outside the sandbox verifies the token, checks whether the tool is enabled, and attaches the real key to that single call. Database queries run read-only with a 30-second timeout and a 200-row cap enforced outside the prompt. The author notes this stops key leakage but not prompt injection misusing enabled tools, and that a named-secret request path and per-tool approval remain open trade-offs.