## TL;DR
Never put a break-glass password in email or chat; deliver it through a one-time secret link with a short expiry. Generate the link, send only the link to the verified recipient, and log the disclosure without recording the secret itself.

## Steps
1. Store the rotated password in a one-time secret service with a short expiry.
   Expected: The secret exists in exactly one protected place.
2. Verify the recipient's identity through your standard verification process.
   Expected: The right person receives access.
3. Send only the one-time link, never the password, and confirm it was retrieved.
   Expected: The secret is never in mail history.
4. Log the disclosure event with recipient and timestamp, without the secret value.
   Expected: The audit is complete and safe.

## When to use
- The agent rotates or discloses break-glass credentials
- Passwords currently travel over email or chat
- Compliance forbids cleartext credential transmission

## When not to use
- A privileged access management vault handles the handoff already
- No break-glass accounts exist
- The agent never touches credentials

## Why this happens
Email is stored, forwarded, and searched forever, so a cleartext password in mail is a permanent credential leak to everyone with mailbox access. A one-time link keeps the secret out of every log and inbox while still reaching the verified human.

## Edge cases
- The one-time link must truly be single-use, or forwarding the mail forwards the secret.
- Expiry should be short enough that a delayed recipient triggers reissue, not a stale secret.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_1eXiERTQ8ECkrlbruLJLAg