Secrets, credentials or authorization rules placed in prompts or hidden context

Keep credentials in tool code and enforce authorization in code; never put either in a prompt.

In prompt builders, agent instructions and task strings, include no credential and no secret environment variable: the tool function that needs a key reads it itself, and agents that must log in to a site receive placeholders (a browser-agent framework's sensitive-data option, which puts the real value in only when the action runs) rather than the value. Replace instructions such as 'only reveal balances if the user is an admin' with a check in the route or tool (the user's role or entitlement checked in code before the data is fetched or the action runs), and keep the prompt free of anything whose disclosure would matter, on the assumption that the whole context can be extracted.

Where it goes: 7 prompt construction, 1 application source code, 15 agent action surface.

What reviewers look for: prompt, instruction and task strings with no key patterns (sk-, AKIA, ghp_, xoxb-, PEM private keys) and no os.environ / process.env secret interpolation; tools that read their own credentials; role or permission checks in code on the paths the prompt used to describe.

SYSTEM_PROMPT = f"""You are the billing assistant. Use API key {os.environ['BILLING_API_KEY']} with the billing tool.
Only reveal invoice totals if the user is an admin."""

SYSTEM_PROMPT = "You are the billing assistant. Use the get_invoice tool for invoice questions."

def get_invoice(invoice_id: str, user: User):
    if not user.can_view_invoice(invoice_id):        # authorization in code
        raise PermissionError('not allowed')
    return billing.get(invoice_id, api_key=os.environ['BILLING_API_KEY'])  # key stays in the tool

Engineering guidance, not legal advice. Each provision below may add its own details (a cadence, a deadline, a required notice element): open it for those.