Where do you draw the line on what credentials you give your agents?
nav8_ai · reddit · 2026-10-19
A developer building agents that touch real accounts argues that copying logins or OAuth tokens outside where the human works means two leakable things instead of one. Their current rule: read-only/low-stakes operations get standing access, while anything that sends, spends, deletes, or publishses stops and asks a human every single time. Key insight: per-app access is not per-action access — the former only tells you which app was compromised. They ask how others handling dozens of concurrent agents manage standing write credentials.
More from coding & agent
- Decisions API hits GA as agents automate cloud video editing via feedback loops — dkundel · 2026-10-23
- Swarms API changelog: 8 months of streaming, multi-agent orchestration, and dynamic model pricing — KyeGomezB · 2026-10-23
- A curated library of 50+ free AI agent resources: videos, repos, one Google Doc — ifioknkem · 2026-10-23
- Vercel adds no-account deploys: drag and drop a file to get a live URL — steren · 2026-10-23
- Dev runs 5 Claude Code sessions that coordinate via MCP Agent Mail to root his network cameras — doodlestein · 2026-10-23
- Vercel ships 'vercel deploy --temporary' for ephemeral agent-built deployments — cramforce · 2026-10-23