A SecretRef hides a key from a manifest, not from the agent. Keep chat, model and tool master keys outside AX Task in an adapter and authorized proxies. Give the Task only narrow, short-lived authority that it may read and use. AX workload identity needs separate verification.