Agent credentials for team leads
Giving a team’s AI agents real access without handing them the keys: storage, scopes, revocation, audit, sharing, and rollout.
Start with part 1 →Part 1 · September 1, 2026 · 6 min read
Your engineers are handing private keys to AI agents. Here's what that means.
Every agent your team connects ends up holding real API keys. Here's where those keys hide today and how to keep them out of the model's context.
Part 2 · September 4, 2026 · 5 min read
A team lead's guide to AI agent credentials
Who owns the keys when your team's AI agents call real services? A practical model for team, personal, and shared credentials.
Part 3 · September 8, 2026 · 5 min read
Where to store API keys for AI agents (not in agent configs)
MCP configs and .env files spread API keys across every laptop and agent. Here's how to connect agents to services without putting keys in config files.
Part 4 · September 11, 2026 · 5 min read
AI agent GitHub access without handing over your token
Let an AI agent read repos, open PRs, and check CI without ever seeing a GitHub token. A step-by-step setup with fine-grained tokens and Kody.
Part 5 · September 15, 2026 · 5 min read
Least privilege for AI agents, a practical setup
A layer-by-layer least-privilege setup for AI agents: provider scopes, host allowlists, fill placement, package-only keys, locks, and expiry.
Part 6 · September 18, 2026 · 5 min read
Sharing credentials across Claude Code, Cursor, and Codex without copying secrets
Your engineers use Claude Code, Cursor, and Codex, each with its own copy of every key. How to give every assistant the same access with zero copies.
Part 7 · September 22, 2026 · 5 min read
Bring your own key, letting each teammate run shared tools as themselves
Shared agent tools shouldn't run as whoever built them. How to let each teammate run the same tool under their own account, with no keys shared.
Part 8 · September 25, 2026 · 5 min read
How to revoke AI agent access in one place
When an agent misbehaves or a laptop goes missing, how many places do you revoke? Here's how to make agent access something you can cut off fast.
Part 9 · September 29, 2026 · 5 min read
An MCP security checklist for engineering managers
A practical MCP security checklist for engineering managers. What to ask about every MCP server your team's AI agents use, and what good looks like.
Part 10 · October 2, 2026 · 5 min read
An AI agent audit log for production access
When an AI agent touches production, can you say who ran what, through which client, and what happened? How to get an agent audit trail you can use.
Part 11 · October 6, 2026 · 6 min read
AI agent guardrails for your team, without killing autonomy
How much should your team's AI agents do without asking? A practical way to set autonomy guardrails that are enforced by the platform, not the prompt.
Part 12 · October 9, 2026 · 5 min read
How to share AI workflows with your team
"Copy my prompt" doesn't scale. A concrete way to share AI agent workflows with teammates, teams, and contractors without sharing anyone's keys.
Part 13 · October 13, 2026 · 5 min read
The hidden cost of AI tooling for engineering teams when everyone builds their own
Five engineers, five private scripts doing the same job. Why duplicated agent tooling costs more than it looks, and how to build it once for the team.
Part 14 · October 16, 2026 · 5 min read
When an engineer quits, their AI workflows break or keep running on their keys
When an engineer leaves, their agent workflows often leave with them or keep running on their keys. How to make AI workflows survive offboarding.
Part 15 · October 20, 2026 · 5 min read
AI agent skills vs packages, turning prompts into reviewable code
Agent skills tell a model what to do; packages are code that does it. When to use each, and how to turn a fragile prompt into reviewable code.
Part 16 · October 23, 2026 · 5 min read
Why AI agent costs keep growing (and how deterministic tools cut tokens)
Agents re-reason the same tasks every day, and you pay for every token. How saving repeated work as deterministic code cuts AI agent costs.
Part 17 · October 27, 2026 · 5 min read
How to avoid AI assistant lock-in, build once and use from any agent
Workflows built inside one AI assistant are stuck there. How to keep your team's agent tooling portable across Claude Code, Cursor, Codex, and ChatGPT.
Part 18 · October 29, 2026 · 5 min read
Internal tools built with AI that reuse your team's credentials
Agents can build an internal dashboard in an afternoon. The hard part is auth, keys, and hosting. How to ship one on credentials you already have.
Part 19 · October 31, 2026 · 5 min read
Why "just use AWS Lambda" breaks down for teams using AI agents
Lambda can run the code your agents write. The trouble is everything around it, like IAM, secrets, deploys, and review. Here's where it breaks for teams.
Part 20 · November 3, 2026 · 5 min read
How to roll out AI agents to your team when it isn't AI-forward yet
Not everyone on your team wants an AI agent. A practical rollout plan that starts small, keeps keys safe, and lets skeptics adopt at their own pace.