diff --git a/lib/flags/consts/consts.go b/lib/flags/consts/consts.go
new file mode 100644
index 0000000..7ed0112
--- /dev/null
+++ b/lib/flags/consts/consts.go
@@ -0,0 +1,12 @@
+// Package consts defines named constants whose values are interpreted by the flags package.
+package consts
+
+const (
+	// Environment variable whose value points to a directory containing
+	// the state of a Principal.  (Private key, blessings, recognized root
+	// certificates etc.)
+	VeyronCredentials = "VEYRON_CREDENTIALS"
+	// Prefix of all environment variables that point to roots of the
+	// veyron namespace, used to resolve non-rooted object names.
+	NamespaceRootPrefix = "NAMESPACE_ROOT"
+)
diff --git a/lib/flags/flags.go b/lib/flags/flags.go
index 0e664e4..b1313e1 100644
--- a/lib/flags/flags.go
+++ b/lib/flags/flags.go
@@ -5,6 +5,8 @@
 	"fmt"
 	"os"
 	"strings"
+
+	"veyron.io/veyron/veyron/lib/flags/consts"
 )
 
 // FlagGroup is the type for identifying groups of related flags.
@@ -164,12 +166,11 @@
 			continue
 		}
 		k, v := p[0], p[1]
-		if strings.HasPrefix(k, "NAMESPACE_ROOT") && len(v) > 0 {
+		if strings.HasPrefix(k, consts.NamespaceRootPrefix) && len(v) > 0 {
 			roots = append(roots, v)
 		}
 	}
-	creds := os.Getenv("VEYRON_CREDENTIALS")
-	return roots, creds
+	return roots, os.Getenv(consts.VeyronCredentials)
 }
 
 // Parse parses the supplied args, as per flag.Parse
diff --git a/lib/flags/flags_test.go b/lib/flags/flags_test.go
index 4e9c31a..c802942 100644
--- a/lib/flags/flags_test.go
+++ b/lib/flags/flags_test.go
@@ -8,6 +8,7 @@
 	"testing"
 
 	"veyron.io/veyron/veyron/lib/flags"
+	"veyron.io/veyron/veyron/lib/flags/consts"
 )
 
 func TestFlags(t *testing.T) {
@@ -74,20 +75,21 @@
 	}
 }
 
-const credEnvVar = "VEYRON_CREDENTIALS"
-const rootEnvVar = "NAMESPACE_ROOT"
-const rootEnvVar0 = "NAMESPACE_ROOT0"
+const (
+	rootEnvVar  = consts.NamespaceRootPrefix
+	rootEnvVar0 = consts.NamespaceRootPrefix + "0"
+)
 
 func TestEnvVars(t *testing.T) {
-	oldcreds := os.Getenv(credEnvVar)
-	defer os.Setenv(credEnvVar, oldcreds)
+	oldcreds := os.Getenv(consts.VeyronCredentials)
+	defer os.Setenv(consts.VeyronCredentials, oldcreds)
 
 	oldroot := os.Getenv(rootEnvVar)
 	oldroot0 := os.Getenv(rootEnvVar0)
 	defer os.Setenv(rootEnvVar, oldroot)
 	defer os.Setenv(rootEnvVar0, oldroot0)
 
-	os.Setenv(credEnvVar, "bar")
+	os.Setenv(consts.VeyronCredentials, "bar")
 	fl := flags.CreateAndRegister(flag.NewFlagSet("test", flag.ContinueOnError), flags.Runtime)
 	if err := fl.Parse([]string{}); err != nil {
 		t.Fatalf("unexpected error: %s", err)
diff --git a/lib/modules/core/core_test.go b/lib/modules/core/core_test.go
index 19ee38b..23037c0 100644
--- a/lib/modules/core/core_test.go
+++ b/lib/modules/core/core_test.go
@@ -14,6 +14,7 @@
 	"veyron.io/veyron/veyron2/vlog"
 
 	"veyron.io/veyron/veyron/lib/expect"
+	"veyron.io/veyron/veyron/lib/flags/consts"
 	"veyron.io/veyron/veyron/lib/modules"
 	"veyron.io/veyron/veyron/lib/modules/core"
 	"veyron.io/veyron/veyron/lib/testutil"
@@ -78,7 +79,7 @@
 	if t.Failed() {
 		return nil, nil, rootSession.Error()
 	}
-	sh.SetVar("NAMESPACE_ROOT", rootName)
+	sh.SetVar(consts.NamespaceRootPrefix, rootName)
 	mountAddrs := make(map[string]string)
 	mountAddrs["root"] = rootName
 
@@ -166,7 +167,7 @@
 		t.Errorf("got %v, want %v", got, want)
 	}
 
-	// Run the ls command in a subprocess, with NAMESPACE_ROOT as set above.
+	// Run the ls command in a subprocess, with consts.NamespaceRootPrefix as set above.
 	lse, err := sh.Start(core.LSExternalCommand, nil, "...")
 	if err != nil {
 		t.Fatalf("unexpected error: %s", err)
@@ -180,9 +181,10 @@
 
 	pattern = ""
 	for _, n := range mountPoints {
-		// Since the LSExternalCommand runs in a subprocess with NAMESPACE_ROOT
-		// set to the name of the root mount table it sees to the relative name
-		// format of the mounted mount tables.
+		// Since the LSExternalCommand runs in a subprocess with
+		// consts.NamespaceRootPrefix set to the name of the root mount
+		// table it sees to the relative name format of the mounted
+		// mount tables.
 		pattern = pattern + "^R[\\d]+=(" + n + "$)|"
 	}
 	pattern = pattern[:len(pattern)-1]
diff --git a/lib/modules/shell.go b/lib/modules/shell.go
index 1bf3e61..1f2a016 100644
--- a/lib/modules/shell.go
+++ b/lib/modules/shell.go
@@ -49,6 +49,7 @@
 	"sync"
 	"time"
 
+	"veyron.io/veyron/veyron/lib/flags/consts"
 	"veyron.io/veyron/veyron2/vlog"
 )
 
@@ -79,15 +80,14 @@
 
 var child = &childRegistrar{mains: make(map[string]*childEntryPoint)}
 
-// NewShell creates a new instance of Shell. If this new instance is
-// is a test and no credentials have been configured in the environment
-// via VEYRON_CREDENTIALS then CreateAndUseNewCredentials will be used to
-// configure a new ID for the shell and its children.
-// NewShell takes optional regexp patterns that can be used to specify
-// subprocess commands that are implemented in the same binary as this shell
-// (i.e. have been registered using modules.RegisterChild) to be
-// automatically added to it. If the patterns fail to match any such command
-// then they have no effect.
+// NewShell creates a new instance of Shell. If this new instance is is a test
+// and no credentials have been configured in the environment via
+// consts.VeyronCredentials then CreateAndUseNewCredentials will be used to
+// configure a new ID for the shell and its children.  NewShell takes optional
+// regexp patterns that can be used to specify subprocess commands that are
+// implemented in the same binary as this shell (i.e. have been registered
+// using modules.RegisterChild) to be automatically added to it. If the
+// patterns fail to match any such command then they have no effect.
 func NewShell(patterns ...string) *Shell {
 	// TODO(cnicolaou): should create a new identity if one doesn't
 	// already exist
@@ -97,7 +97,7 @@
 		handles:      make(map[Handle]struct{}),
 		startTimeout: time.Minute,
 	}
-	if flag.Lookup("test.run") != nil && os.Getenv("VEYRON_CREDENTIALS") == "" {
+	if flag.Lookup("test.run") != nil && os.Getenv(consts.VeyronCredentials) == "" {
 		if err := sh.CreateAndUseNewCredentials(); err != nil {
 			// TODO(cnicolaou): return an error rather than panic.
 			panic(err)
@@ -125,7 +125,7 @@
 		return err
 	}
 	sh.credDir = dir
-	sh.SetVar("VEYRON_CREDENTIALS", sh.credDir)
+	sh.SetVar(consts.VeyronCredentials, sh.credDir)
 	return nil
 }
 
diff --git a/lib/signals/signals_test.go b/lib/signals/signals_test.go
index b045ef9..abe2e27 100644
--- a/lib/signals/signals_test.go
+++ b/lib/signals/signals_test.go
@@ -19,6 +19,7 @@
 	"veyron.io/veyron/veyron2/services/mgmt/appcycle"
 
 	"veyron.io/veyron/veyron/lib/expect"
+	"veyron.io/veyron/veyron/lib/flags/consts"
 	"veyron.io/veyron/veyron/lib/modules"
 	"veyron.io/veyron/veyron/lib/testutil"
 	"veyron.io/veyron/veyron/lib/testutil/security"
@@ -338,7 +339,7 @@
 	defer os.RemoveAll(childcreds)
 	configServer, configServiceName, ch := createConfigServer(t)
 	defer configServer.Stop()
-	sh.SetVar("VEYRON_CREDENTIALS", childcreds)
+	sh.SetVar(consts.VeyronCredentials, childcreds)
 	sh.SetVar(mgmt.ParentNodeManagerConfigKey, configServiceName)
 	h, err := sh.Start("handleDefaults", nil)
 	if err != nil {
diff --git a/runtimes/google/rt/mgmt_test.go b/runtimes/google/rt/mgmt_test.go
index 38c5593..4eea73d 100644
--- a/runtimes/google/rt/mgmt_test.go
+++ b/runtimes/google/rt/mgmt_test.go
@@ -17,6 +17,7 @@
 	"veyron.io/veyron/veyron2/services/mgmt/appcycle"
 
 	"veyron.io/veyron/veyron/lib/expect"
+	"veyron.io/veyron/veyron/lib/flags/consts"
 	"veyron.io/veyron/veyron/lib/modules"
 	"veyron.io/veyron/veyron/lib/testutil"
 	"veyron.io/veyron/veyron/lib/testutil/security"
@@ -289,7 +290,7 @@
 	childcreds := security.NewVeyronCredentials(r.Principal(), appCmd)
 	configServer, configServiceName, ch := createConfigServer(t, r)
 	sh := modules.NewShell(appCmd)
-	sh.SetVar("VEYRON_CREDENTIALS", childcreds)
+	sh.SetVar(consts.VeyronCredentials, childcreds)
 	sh.SetVar(mgmt.ParentNodeManagerConfigKey, configServiceName)
 	h, err := sh.Start("app", nil)
 	if err != nil {
diff --git a/runtimes/google/rt/rt_test.go b/runtimes/google/rt/rt_test.go
index 07bf6fd..e76dcd5 100644
--- a/runtimes/google/rt/rt_test.go
+++ b/runtimes/google/rt/rt_test.go
@@ -17,6 +17,7 @@
 	"veyron.io/veyron/veyron2/vlog"
 
 	"veyron.io/veyron/veyron/lib/expect"
+	"veyron.io/veyron/veyron/lib/flags/consts"
 	"veyron.io/veyron/veyron/lib/modules"
 	"veyron.io/veyron/veyron/lib/testutil"
 	vsecurity "veyron.io/veyron/veyron/security"
@@ -26,10 +27,6 @@
 	local security.Principal
 }
 
-// Environment variable pointing to a directory where information about a
-// principal (private key, blessing store, blessing roots etc.) is stored.
-const veyronCredentialsEnvVar = "VEYRON_CREDENTIALS"
-
 func (*context) Method() string                            { return "" }
 func (*context) Name() string                              { return "" }
 func (*context) Suffix() string                            { return "" }
@@ -223,7 +220,7 @@
 	principal := createCredentialsInDir(t, cdir)
 
 	// directory supplied by the environment.
-	credEnv := []string{veyronCredentialsEnvVar + "=" + cdir}
+	credEnv := []string{consts.VeyronCredentials + "=" + cdir}
 
 	h, err := sh.Start("runner", credEnv)
 	if err != nil {
@@ -268,12 +265,12 @@
 
 	// A credentials directory may, or may, not have been already specified.
 	// Either way, we want to use our own, so we set it aside and use our own.
-	origCredentialsDir := os.Getenv(veyronCredentialsEnvVar)
-	defer os.Setenv(veyronCredentialsEnvVar, origCredentialsDir)
+	origCredentialsDir := os.Getenv(consts.VeyronCredentials)
+	defer os.Setenv(consts.VeyronCredentials, origCredentialsDir)
 
 	// Test that with VEYRON_CREDENTIALS unset the runtime's Principal
 	// is correctly initialized.
-	if err := os.Setenv(veyronCredentialsEnvVar, ""); err != nil {
+	if err := os.Setenv(consts.VeyronCredentials, ""); err != nil {
 		t.Fatal(err)
 	}
 
@@ -293,7 +290,7 @@
 	defer os.RemoveAll(cdir1)
 	principal := createCredentialsInDir(t, cdir1)
 	// directory supplied by the environment.
-	credEnv := []string{veyronCredentialsEnvVar + "=" + cdir1}
+	credEnv := []string{consts.VeyronCredentials + "=" + cdir1}
 
 	pubkey, err = collect(sh, "principal", credEnv)
 	if err != nil {
diff --git a/security/agent/agentd/main.go b/security/agent/agentd/main.go
index 28e448d..7efffbe 100644
--- a/security/agent/agentd/main.go
+++ b/security/agent/agentd/main.go
@@ -8,6 +8,7 @@
 	"os/exec"
 	"os/signal"
 	"syscall"
+	"veyron.io/veyron/veyron/lib/flags/consts"
 	_ "veyron.io/veyron/veyron/profiles"
 	vsecurity "veyron.io/veyron/veyron/security"
 	"veyron.io/veyron/veyron/security/agent"
@@ -24,16 +25,18 @@
 	flag.Usage = func() {
 		fmt.Fprintf(os.Stderr, `Usage: %s [agent options] command command_args...
 
-Loads the private key specified in under privatekey.pem in VEYRON_CREDENTIALS into memory, then
+Loads the private key specified in under privatekey.pem in %v into memory, then
 starts the specified command with access to the private key via the
 agent protocol instead of directly reading from disk.
 
-`, os.Args[0])
+`, os.Args[0], consts.VeyronCredentials)
 		flag.PrintDefaults()
 	}
-	dir := os.Getenv("VEYRON_CREDENTIALS")
+	// TODO(ashankar,cnicolaou): Should flags.Parse be used instead? But that adds unnecessary
+	// flags like "--veyron.namespace.root", which has no meaning for this binary.
+	dir := os.Getenv(consts.VeyronCredentials)
 	if len(dir) == 0 {
-		vlog.Fatal("VEYRON_CREDENTIALS must be set to directory")
+		vlog.Fatalf("The %v environment variable must be set to a directory", consts.VeyronCredentials)
 	}
 
 	p, passphrase, err := newPrincipalFromDir(dir)
@@ -52,7 +55,7 @@
 	if err = os.Setenv(agent.FdVarName, "3"); err != nil {
 		log.Fatalf("setenv: %v", err)
 	}
-	if err = os.Setenv("VEYRON_CREDENTIALS", ""); err != nil {
+	if err = os.Setenv(consts.VeyronCredentials, ""); err != nil {
 		log.Fatalf("setenv: %v", err)
 	}
 
diff --git a/services/mgmt/node/config/config.go b/services/mgmt/node/config/config.go
index e7afa99..68f68e1 100644
--- a/services/mgmt/node/config/config.go
+++ b/services/mgmt/node/config/config.go
@@ -23,6 +23,7 @@
 	"path/filepath"
 	"strings"
 
+	"veyron.io/veyron/veyron/lib/flags/consts"
 	"veyron.io/veyron/veyron2/services/mgmt/application"
 )
 
@@ -122,7 +123,7 @@
 			continue
 		}
 		k, v := p[0], p[1]
-		if strings.HasPrefix(k, "NAMESPACE_ROOT") {
+		if strings.HasPrefix(k, consts.NamespaceRootPrefix) {
 			settings[k] = v
 		}
 	}
diff --git a/services/mgmt/node/impl/util_test.go b/services/mgmt/node/impl/util_test.go
index c039bbd..91caa91 100644
--- a/services/mgmt/node/impl/util_test.go
+++ b/services/mgmt/node/impl/util_test.go
@@ -20,6 +20,7 @@
 	"veyron.io/veyron/veyron2/vlog"
 
 	"veyron.io/veyron/veyron/lib/expect"
+	"veyron.io/veyron/veyron/lib/flags/consts"
 	"veyron.io/veyron/veyron/lib/modules"
 	"veyron.io/veyron/veyron/lib/modules/core"
 	"veyron.io/veyron/veyron/lib/testutil/security"
@@ -53,13 +54,13 @@
 
 func credentialsForChild(blessing string) (string, []string) {
 	creds := security.NewVeyronCredentials(rt.R().Principal(), blessing)
-	return creds, []string{"VEYRON_CREDENTIALS=" + creds}
+	return creds, []string{consts.VeyronCredentials + "=" + creds}
 }
 
 func createShellAndMountTable(t *testing.T) (*modules.Shell, func()) {
 	sh := core.NewShell()
 	// The shell, will, by default share credentials with its children.
-	sh.ClearVar("VEYRON_CREDENTIALS")
+	sh.ClearVar(consts.VeyronCredentials)
 
 	mtName, mtHandle, _ := startRootMT(t, sh)
 	// Make sure the root mount table is the last process to be shutdown
@@ -78,7 +79,7 @@
 	if _, err := sh.Start(core.SetNamespaceRootsCommand, nil, mtName); err != nil {
 		t.Fatalf("%s: unexpected error: %s", loc(1), err)
 	}
-	sh.SetVar("NAMESPACE_ROOT", mtName)
+	sh.SetVar(consts.NamespaceRootPrefix, mtName)
 	return sh, fn
 }
 
diff --git a/tools/naming/simulator/driver.go b/tools/naming/simulator/driver.go
index 4f944ca..e27e4bb 100644
--- a/tools/naming/simulator/driver.go
+++ b/tools/naming/simulator/driver.go
@@ -19,6 +19,7 @@
 	"veyron.io/veyron/veyron2/rt"
 
 	"veyron.io/veyron/veyron/lib/expect"
+	"veyron.io/veyron/veyron/lib/flags/consts"
 	"veyron.io/veyron/veyron/lib/modules"
 	"veyron.io/veyron/veyron/lib/modules/core"
 	_ "veyron.io/veyron/veyron/profiles"
@@ -111,7 +112,7 @@
 
 	shell := modules.NewShell()
 	defer shell.Cleanup(os.Stderr, os.Stderr)
-	if os.Getenv("VEYRON_CREDENTIALS") == "" {
+	if os.Getenv(consts.VeyronCredentials) == "" {
 		shell.CreateAndUseNewCredentials()
 	}
 
diff --git a/tools/servicerunner/main.go b/tools/servicerunner/main.go
index 6b3f501..c32a454 100644
--- a/tools/servicerunner/main.go
+++ b/tools/servicerunner/main.go
@@ -12,6 +12,7 @@
 	"veyron.io/veyron/veyron2/rt"
 
 	"veyron.io/veyron/veyron/lib/expect"
+	"veyron.io/veyron/veyron/lib/flags/consts"
 	"veyron.io/veyron/veyron/lib/modules"
 	"veyron.io/veyron/veyron/lib/modules/core"
 	_ "veyron.io/veyron/veyron/profiles"
@@ -67,7 +68,7 @@
 	defer sh.Cleanup(os.Stderr, os.Stderr)
 	// TODO(sadovsky): Shell only does this for tests. It would be better if it
 	// either always did it or never did it.
-	if os.Getenv("VEYRON_CREDENTIALS") == "" {
+	if os.Getenv(consts.VeyronCredentials) == "" {
 		panicOnError(sh.CreateAndUseNewCredentials())
 	}
 	// TODO(sadovsky): The following line will not be needed if the modules
@@ -80,10 +81,11 @@
 	panicOnError(err)
 	updateVars(h, vars, "MT_NAME")
 
-	// Set NAMESPACE_ROOT env var, consumed downstream by proxyd among others.
-	// NOTE(sadovsky): If this is not set, proxyd takes several seconds to start;
-	// if it is set, proxyd starts instantly. Fun!
-	sh.SetVar("NAMESPACE_ROOT", vars["MT_NAME"])
+	// Set consts.NamespaceRootPrefix env var, consumed downstream by proxyd
+	// among others.
+	// NOTE(sadovsky): If this is not set, proxyd takes several seconds to
+	// start; if it is set, proxyd starts instantly. Fun!
+	sh.SetVar(consts.NamespaceRootPrefix, vars["MT_NAME"])
 
 	// NOTE(sadovsky): The proxyd binary requires --protocol and --address flags
 	// while the proxyd command instead uses ListenSpec flags.