Corey JamesA gatekeeper holds each domain credential
The usual way to give an agent access is a scoped token and hope. In Agent Swarm I wanted a plain property instead: an agent cannot call what it was not granted and never holds a credential it does not need. How sensitive an action is depends on which agent holds the credential for it, so I decide which agent may hold one, and every other agent asks that one for an outcome.
Sensitivity follows the holder.
Git is the domain with its own gatekeeper. A coding agent on a local open-source model edits, tests and pushes to its own branch in a throwaway container, then asks the gatekeeper persona to open a merge request. The gatekeeper checks the request, acts with its own credential and returns the result with an audit trail. The worker never receives the means to push to the main branch. See A coding agent that never holds the keys.
Secrets used for the agent, never shown to it
Tools that need a secret use it on the agent's behalf and keep it away from the model. Secret bytes are never logged anywhere in the codebase, and the operator's own tools manage a secret's whole lifecycle without displaying it.
One login per managed seat
AgentOS runs vendors' authenticated CLIs as managed seats, and I decided a seat's login belongs to that seat alone. The operator holds the login, AgentOS refers to it by an opaque reference, and it is copied into a private per-seat state directory.
Container images carry no credentials, so an image can be shared or inspected safely. The estate uses a mix of API keys and subscription logins, and the isolation covers both.