Your Semantic Kernel agent has plugins. Civic makes sure the credentials don't leak.
Semantic Kernel connects agents to enterprise plugins. Civic keeps API keys out of the runtime and error logs.
The plugin exception included the connection string. Application Insights captured it.
Just imagine, one day…
You build a Semantic Kernel agent with plugins for Azure SQL, Blob Storage, and Microsoft Graph. Each plugin uses a connection string or API key from the app configuration. During a database query, a transient timeout triggers an unhandled exception.
The exception's inner message includes the full Azure SQL connection string with the server, database name, and password. Application Insights ingests the exception. 15 developers have access to the Application Insights workspace. The connection string sits in the exception traces for weeks.
Connection strings in exception logs are the most common credential leak in .NET agent applications.
Without credential isolation, exceptions become credential leaks.
It does things you did not intend
A database timeout dumped the connection string into an exception trace. Application Insights captured it. 15 people can see the password.
You cannot prove what happened
Who viewed the exception trace? Was the connection string copied? Application Insights shows queries but the credential was visible for weeks.
You cannot stop it fast enough
Rotating the password means updating every service that uses it. The old credential is still in Application Insights until you purge the data.
It gets confused and you never know
The Azure SQL client includes the connection string in timeout exceptions by default. Nobody configured it to redact because nobody expected an agent to trigger it.
Your Semantic Kernel agent calls Civic. Credentials stay in Civic, not in exceptions.
Connect Semantic Kernel through Civic in three steps
Add Azure SQL and Blob Storage.
Scope SQL to read-only on analytics.
Blob Storage: read-only.
Done. 2 tools connected:
✓ Azure SQL — analytics, read-only
✓ Blob Storage — read-only
Your MCP URL is ready to copy.
The same scenario. Different outcomes.
Without Civic, exceptions include connection strings. With Civic, credentials never enter the agent runtime.
Ship safer with Civic
We'll help you implement authenticated, scoped, and auditable access without slowing down your build.