Comment by devmor

Don't give secrets to agents at all that you don't plan on revoking immediately after.

If you have allowed an agent to access any kind of credential, you should assume it is no longer private.