用用户级密钥在自有密钥上运行智能体

You don’t hand a colleague your GitHub token. Agorid v2026.707.0 applies the same rule to agents: secrets can now be scoped to the individual human, not just the company. Each user stores their own value for a secret, and Agorid checks that the human behind a run has supplied what it needs before the run dispatches (#8825).

每个 secret 一个值

Until now, a secret held one company-wide value (the secrets reference covers that model, its providers, and vaults). One value works for one person. The moment a second human joins, they either borrow someone else’s keys or can’t run agents at all.

工作方式

各块按序落地。secret definition 现可 user-scoped，各用户存自己的值。definition 绑定 environment，需要凭证的 run 会声明。新的 responsible-user run attribution 将每次 run 绑定到所代表的人类。run dispatch 前，Agorid 确定性检查该用户是否已提供所需值，缺失凭证在 run 开始前即暴露。

You see the check in the product. If a secret you’re responsible for has no value yet, Agorid warns you as you create the task, names the missing secret, and lets you set your value on the spot.

凡有 env 处皆可引用 secret

The same release replaces the legacy environment variables editor with a single reusable editor used everywhere environment variables are configured: agents, projects, routines, and company environments. It handles text values, secret references, draft rows, and sensitive-value warnings consistently, with a clearer affordance for converting a plain value into a secret reference (#8930).

开始使用

Define a user-scoped secret, have each teammate store their own value, and bind the definition to the environments that need it. Dispatch does the checking from there. The user-scoped secrets guide explains secret scopes and responsible-user attribution in depth.

多用户与云执行的基础工作

The release notes call user-scoped secrets “a real prerequisite for safe multi-user and cloud execution.” The immediate payoff is concrete: the next person who joins your company supplies their own keys and runs agents the same day, and every run is attributable to the human behind it.