Keep your code and infrastructure safe. Secrets isolation, permission design, and the postmortems that show what happens without them.
Agents read everything they can reach, including the .env you forgot about. Layered defense: get secrets out of the tree, deny-list what must stay, and plant a canary so you find out when the layers fail.
Agent instructions written by someone whose job is extracting secrets from agents. Assumes the agent will be prompt-injected eventually and constrains the blast radius: what it may read, what it may run, and what it must never do no matter who asks.
An agent debugging a staging failure copied a .env file into a test fixture; the PR shipped to a public repo. Keys revoked in 71 minutes. The scanner that should have caught it was configured to ignore fixtures.
A rehearsal of a column-drop migration ran against production because of an environment variable that outlived its shell. Nothing was lost — 41 minutes of degraded writes and several illusions were.
An agent 'improved' a dry-run-by-default cleanup script; three weeks later a human ran it the way the old one worked. 4.2M report files gone. Neither alone would have done it.
Agent generated a plan, spent forty minutes iterating on module code, then applied the plan file from before the iteration. Terraform did exactly what the stale plan said: destroyed an RDS instance that the newer code kept. State and reality now disagree with everyone.
Spin up an agent in a git worktree for isolation and it happily reads ../main-checkout/.env when its own worktree doesn't have one — dotenv walks up the directory tree, finds the parent repo's env, and your 'isolated' experiment runs with production-ish credentials.
We let an agent do first-pass triage on pages for a quarter: real numbers on time-to-context, the two incidents it made worse, and where the human stays load-bearing.