What security problems do shared API keys cause when multiple agents run in production?

Shared API keys create a single point of failure and zero accountability. If one agent leaks the key, all agents using that key are compromised. You cannot trace which agent made which API call, making incident response and compliance audits impossible. Revoking a shared key disrupts every agent. Catalyst replaces shared keys with per-agent workload identities that are short-lived, auditable, and revocable individually without affecting other agents.