The credential's status and creation time in the secrets tool, and the dependent service's authentication check after the swap.
Workflows · Credential rotation
The payments owner checks dependencies before credential rotation.
Close the CC6.1 credential test: rotate the production payments API credential after its service owner checks the dependents, read the new status back, and keep the receipt.
Example workflow. Execution requires a configured tool with provider permissions for this action; see the connection’s operation reference or bring your company tool to the demo.
Agent request
Rotate the production payments API credential
A rotation without the dependent service update can stop payment requests from authenticating.
- Identity
- security-agent · Security engineering
- Target
- production/payments-api
- Cost
- Recorded agent cost
- Evidence
- Credential reference, dependent service, and validation check
SOC 2 CC6.1
Sensitive: waits for a named approver.
The credential reference, the dependent service, the Payments owner's reason, the status before and after, and the re-run of the CC6.1 test.
Policy decision
Production credential rotations require the Payments service owner.
Payments service owner
The action waits until this owner approves or denies it.
Tool call resumes
The secrets tool rotates the credential and records the provider result.
Tool call stays blocked
The current credential remains active and the rotation does not run.
Execution order
The agent request stops before the connected tool runs.
- 01Security agent requests the rotation
- 02Deixic checks the credential, dependency, evidence, and policy
- 03Payments service owner decides
- 04Connected secrets tool returns the rotation result
- 05Deixic reads the credential status back and attaches the receipt to CC6.1
Activity history keeps the request, decision, cost, and result.
Keep the procedure for the next request.
Keep the policy and decision history, save the steps and evidence as a skill, and test changes on real sessions; an approval stays specific to its request.