Credentials & the Safety Spine
Agents do a lot, but never hold the keys to disaster.
This is the most important feature to get right. The principle is simple: agents should be able to do a lot, but never hold the keys to catastrophe. Before you grant autonomy, contain the blast radius — so that even a worst-case action stays recoverable.
Deploys run through Actions, not the agent
Production deploys happen via GitHub Actions + secrets— not from the agent's hands. The agent merges code; the pipeline holds the keys and ships it. That one seam keeps the deploy path deterministic and auditable while the agent stays one step removed from the credentials that matter.
Grant access indirectly
Guard against disastrous data loss
main/prod, so no single actor — human or agent — can ship to production alone.Why it comes first
Every other feature assumes this one is in place. You can multiply agents, promote them into roles, and eventually let routines launch work on their own — but only because each of those actions runs inside this boundary. Get the safety spine right once, and the rest of the ladder is about leverage, not risk.