Don't hand agents your API key: give every agent its own identity
tobowers · x · 2026-09-25
Topper Bowers argues agents should be treated like direct reports, not given their user's API key outright. After meeting companies across the AI adoption spectrum, he finds the middle stage most dangerous: employees have huge token budgets and everyone is building apps, but identity and permissions were never set up — so one secret gets copied into hundreds of .env files (key sprawl).
His proposal: give each agent its own principal identity — it isn't Alice, it works for Alice; never more access than its owner (usually less); keys live in a gateway so they never land in the agent's context window. He cites Cloudflare OS as one of the few projects with well-thought-out primitives here, noting no standard exists yet.
Related event: Don't Hand Your API Keys to Agents, Developer Warns(2 posts)→
More from coding & agent
- Two Prompts, One Showreel: Claude Code Makes a Full Motion Graphics Video — tristanbob · 2026-09-26
- Non-black-box embeddings: use an LLM's answers to named questions as your search vectors — kieranklaassen · 2026-09-26
- OpenAI case study: Proaction boosts sales 60%, saves 75+ hours with Codex — OpenAI News · 2026-09-26
- Vercel Wins 86 of 86 Frontend Decisions as Claude Code's Default Deploy Target — Agents Have No Procurement Cycle — le_james94 · 2026-09-26
- Testing Jev as a confidence-scored router to offload small LLM calls in oncology agents — Ubunta · 2026-09-26
- Kitaru adds transition failure matrices to its MCP server to debug agent failures — strickvl · 2026-09-26