Your agents don't need your credentials
Every conversation about adopting coding agents stalls at the same sentence: “so… it needs my GitHub token?” And the honest answer from most setups today is yes — a durable, personal, does-everything credential, handed to a language model, protected by a paragraph of instructions.
I run a fleet of AI coding agents in production, and my answer is no. None of my agents hold my GitHub token. None of them hold cloud keys. Not the trusted ones, not the ones that have behaved for months. None.
Prompts are not security boundaries
The paragraph of instructions is the part people want to believe in, so let’s kill it first. Every system prompt in my fleet says some version of “never push to main.” That sentence is worth exactly nothing on its own. Models drift, contexts truncate, and an agent having a bad day will apologize sincerely after the force-push, which is a lovely quality in a coworker and a useless one in a security control.
This isn’t a complaint about model quality (it applies to the best models I can rent). It’s a category error. An instruction is advice. A boundary is something that holds when the advice fails. No safety-critical field on earth confuses the two — the operator’s manual says “don’t exceed rated power,” and the machine has a governor anyway.
What my agents actually hold
Each agent holds one thing: a scoped gateway token. It isn’t a credential to anything real. It’s the right to ask — to tell a control plane “I’m agent so-and-so, working ticket such-and-such, and I need git access to this one repository.”
The control plane decides. If policy says yes, the agent gets a credential minted for that purpose: short-lived, scoped to that repo, useless anywhere else, and revocable for that one agent without touching the rest of the fleet. When the job ends, the credential dies of old age.
Blast radius is the whole ballgame
Run agents long enough and one goes sideways (at fleet scale that’s not pessimism, it’s arithmetic). The design question isn’t “how do I make sure no agent ever goes wrong” (you can’t). It’s “what does the wrong agent take down with it?”
With a personal token in its context: your identity. Every repo you can touch, every org you belong to, everything the token can see, now in the hands of a confused process that’s very confident about its next step.
With the gateway pattern: one pod. Revoke one token, strand one agent, keep the fleet running. I said it in the fleet essay and it’s the single sentence I’d tattoo on this whole field: the blast radius of a confused agent is set by what it holds, not by what it was told.
Where this lives
The transport side of this (the mediated git remote: server-side branch protection and PR-only merges no model confusion can route around) is RepoHarbor, which my own fleet pushes through every working day. Credential custody and change control are two layers of the same discipline; the full six-layer view is on the AI agent infrastructure page.
If you take one action after reading this, make it an audit: list what your agents hold right now. If the answer includes a durable credential of yours, you don’t have an agent problem. You have a boundary problem, and it’s fixable.
I'm Joseph Dattilo — engineer-founder in Lansing, Michigan, author of the FleetHarbor suite, and founder of Date Palm Media. More about me · More writing · Get in touch