Corey James- 0provider keys held by any agent; every credential stays server-side
- 7 of 14function crates in the estate carry the tool generator's fingerprints
- 1 personapproves every grant an outside assistant receives, on the consent screen
Agents that do real work against real services need credentials, and the moment one holds a credential there is a key in a transcript, actions nobody can attribute, and a crash window where a charge is doubled or lost.
I built a governed gateway that exposes provider tools, each rebuilt from the provider's API, to managed agents, with credentials held server-side and identity derived from the authenticated caller, so no tool argument can claim to be someone else. Start with Agents with real tools and no keys.
A restart inside the shaded gap either repeats the call or forgets it. Durable accounting wraps every call, so a restart never repeats a provider call, and the customer, price or post the vendor created is captured and tied to the assignment that created it.
Attribution that might be silently dropped is worse than none.
I built the substrate that turns one function definition into an orchestrated, budgeted, agent-callable tool, and a generator that lets agents write new tools inside a sandbox that becomes callable only after a human restart. See Tools that build tools, under governance.
Four services edited in one rollback-protected transaction; a symmetric delete reverses all of it.
Link-time registration: a function is fully wired or the build fails. Reads pass a schema resolver that validates every identifier; writes go only through the governed queue.
And I built the access plane that lets commercial assistants connect to a private tool estate on my terms. See The hardening fix that locked everyone out.