Why are credentials the real risk?
Credentials are the real risk with AI agents because an agent acts through them. Whatever the agent's own safeguards, an agent holding a broad credential can do whatever that credential allows, and if the credential leaks, so can anyone else.
The most common mistake is the shared admin login: a single account with full access to the CRM, the ledger, or the email system, handed to an agent because it was easiest. It is easy, and it fails every property a credential should have.
What does scoped mean?
Scoped means the credential grants the minimum access the role needs and nothing more. A Finance Controller Digital FTE needs read access to bank feeds and the ledger and the ability to propose entries; it does not need the ability to post, to change users, or to see payroll. A Search Visibility FTE needs access to one website's CMS, not to every property the organization owns.
On ftes.ai connections are granted per organization and per property, so scope is a structural feature: one FTE's connection to one property does not reach another property, and the permissions you grant when connecting are the permissions it has.
What does encrypted and unexposed mean?
Encrypted means the stored credential is unreadable without a key, and the key is held separately from the data, so a breach of one does not expose the other. Unexposed means the credential never appears in an API response, a log line, or a workspace view, even to the organization's own administrators.
On ftes.ai integration credentials and API keys are encrypted before storage with a separately held key and never appear in responses or logs. The same applies to a bring-your-own model provider key.
- Encrypted at rest with a separately held key
- Never in responses, logs, or workspace views
- Bring-your-own provider keys handled the same way
- Transport over HTTPS between browser, platform, and connected systems
What does revocable and logged mean?
Revocable means the credential can be removed from one place, at any time, with immediate effect. Logged means every grant and removal is recorded with who did it and when, so the history of what an agent could access is reconstructible.
On ftes.ai any integration can be disconnected from the workspace at any time, and credential changes are part of the audit trail. Connector URLs that carry a credential, such as the one that exposes a Search Visibility FTE to an external AI assistant, are returned exactly once and are rotated rather than recovered if lost.
How should you set up connections?
Set up each connection with the narrowest scope the tool allows, using a dedicated account or token for the Digital FTE rather than a person's login, so that revoking it affects only the FTE. Record which FTE holds which connection, which the workspace's Setup tab shows.
Review connections quarterly alongside the Memory confirmation. Remove any the role no longer needs, and rotate any the tool's own policy requires. The offboarding guide on ftes.ai covers what to do when a role is stopped.
What does a quarterly credential review look like?
A quarterly credential review takes the connections listed per Digital FTE in its Setup tab and asks four questions of each: is it still needed by the role's current remit, is its scope still the narrowest the tool allows, is it a dedicated account or token for the FTE rather than a person's login, and when was it last rotated if the tool's policy requires rotation. Connections that fail the first question are disconnected from the workspace, which revokes them at once and logs the change; connections that fail the second are reconnected with narrower permissions.
The review also reads the audit trail's credential events for the quarter: every connection added or removed, by whom, and any connector links that were rotated. Where a role has grown, the connections tend to have grown with it, and the review is where that accumulation is trimmed. Done alongside the Brand Brain confirmation and the governance audit, it is a short session, and it is the one that most reduces the blast radius of a bad day, because an agent that holds only what it needs can only affect what it needs.