Agentic systems increasingly act with user secrets for APIs, messaging platforms, and cloud services. Today's agent runtimes typically implement authorization by exposure: enabling action often means placing a reusable secret, or a reusable artifact derived from it, inside the runtime, so a transient prompt-injection or tool-side compromise becomes durable account compromise. Existing defenses cover adjacent pieces such as secret storage, scoped delegation, sender-constrained tokens, and runtime monitoring, but leave the combined agentic obligation without a common specification: an untrusted autonomous requester should be able to cause a user-authorized secret-backed operation without gaining reusable authority over it. We formalize this as the Agent Secret Use (ASU) problem and identify seven security properties any solution must satisfy, spanning authorization integrity and secret confidentiality. We propose the Secret-Use Delegation Protocol (SUDP), in which a requester proposes a canonical operation, the user authorizes it with a fresh authenticator-backed grant, and a custodian redeems the grant to perform the bounded use; reusable authority never crosses the requester boundary. We specialize SUDP for LLM-driven agents, where it applies whenever a tool call would exercise user-enrolled authority-bearing material. Under standard cryptographic assumptions, SUDP satisfies all seven properties when integrated with a hardware-rooted runtime. A reference implementation is available at https://github.com/xhyumiracle/sudp.

翻译：[翻译后的摘要] 代理系统越来越多地使用用户密钥来访问API、消息平台和云服务。当前的代理运行时通常通过暴露实现授权：启用操作往往意味着将可复用的密钥，或其派生的人工制品，放置在运行时内部，从而使得一次瞬时的提示注入或工具端妥协演变为持久的账户妥协。现有防御措施涵盖了相邻环节，例如密钥存储、范围限定委派、发送者约束令牌及运行时监控，但未能针对代理系统的组合义务提供通用规范：一个不可信的自主请求者应能够执行由用户授权的密钥支持操作，而无需获得对该密钥的可复用权威。我们将此形式化为代理密钥使用问题，并识别出任何解决方案必须满足的七项安全属性，涵盖授权完整性与密钥机密性。我们提出隐秘使用委派协议，其中请求者提出规范操作，用户使用新鲜认证器支持的授权对其进行授权，保管者兑换该授权以执行有限使用；可复用权威始终不跨越请求者边界。我们将SUDP专门应用于大语言模型驱动的代理，当工具调用涉及用户已注册的权威承载材料时即可应用。在标准密码学假设下，当SUDP与硬件根信任运行时集成时，满足所有七项属性。参考实现见https://github.com/xhyumiracle/sudp。