What counts as a sensitive token. A sensitive token is any credential the AI capability holds to speak to an external system: a GitHub personal access token, a Supabase service-role key, an OpenAI API key, an OAuth access token. When the AI acts, it acts as whoever owns the token.
Why the token's scope matters. A token's authority is what you make of it. A GitHub PAT scoped to one repo is very different from a classic PAT with repo, workflow, and admin:org checked — same shape of secret, different blast radius. Prefer fine-grained tokens with the minimum necessary scope, an expiration set, and per-project isolation.
How to handle one. Never paste a sensitive token into a chat that leaves your machine. Store it in the environment (.env, secret manager) and let the capability read it from there. Rotate on a schedule and rotate immediately if a machine is lost. AgentMaps flags every capability that requires a sensitive token so you can plan credential hygiene up front.