Trusting agents with your secrets: What OpenBao taught us about Agentic Identity

Agentic systems need credentials. They need to authenticate to APIs, access databases, call external services, and do it autonomously, repeatedly, and at speed. The secrets management tooling most organisations rely on was designed for humans and static workloads. It was not designed for non-human identities that spin up, act, and disappear faster than any rotation policy was built to handle.

At ControlPlane, we started experimenting with OpenBao as a foundation for agentic identity management. Not because it was the obvious answer, but because we suspected the secrets management layer was the right place to solve this problem and wanted to find out if we were right.

This session shares what we found. Where the architecture held up, where it surprised us, where it fell short, and what we would do differently. We examine how OpenBao's dynamic secrets, policy engine, and audit capabilities map to the specific demands of autonomous agents, and where the gaps still are.

The honest version of this talk is not a blueprint. It is a practitioner's account of early experimental work in a space where most teams are either ignoring the problem or bolting on identity as an afterthought. If you are building agentic systems and wondering how to handle credentials properly, this is the session that starts that conversation with real findings rather than vendor promises.