Three controls cover 90% of what a security team will ask for. None of them are exciting. All of them are non-negotiable.
- Secrets out of code. Use the platform's secret store (Vercel env, AWS Secrets Manager, etc.). Never commit a model API key.
- Rotation on a schedule. Set a calendar event. 90 days is fine for most keys; some teams do 30.
- Least privilege. The agent's model key should be a separate key from your team's personal keys. The agent's database role should be the narrowest one that lets it do its job.
Knowledge check
0/1 answered1. Which is NOT a useful boring control for an agent in production?
Discussion
0 commentsBe the first to start the conversation.