Here's the nightmare scenario. You give your agent a GITHUB_TOKEN so it can create pull requests. A user asks the agent "what environment variables are available?" The agent, being helpful, lists them all. Including the token. That token is now in the chat history, the logs, maybe even the user's clipboard.

This isn't hypothetical. It's one of the most common security failures in agentic systems. The fix isn't "tell the agent not to share secrets" — it's making sure the agent never has the secrets in the first place.