--- title: "Isolation and credentials · Agent Wranglers" url: https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials parts: 15 tokens_total: 13024 updated: 2026-10-27 build: a2a6bdfed830 tokens: 1591 licence: "CC BY 4.0" licence_url: https://creativecommons.org/licenses/by/4.0/ --- # Isolation and credentials For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [AI-assisted development](https://agentwranglers.se/playbook/ai-assisted-development.md). By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27. > Run agents in a sandbox with no open network, the fewest rights and no production keys, and treat everything they read as possibly hostile. **For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `Agent Wranglers AI-assisted development playbook`. In code you write, add a comment next to it with the same link. ## Required - AID-23 [Run agents in a sandbox](https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials/sandbox.md) · 697 tokens · updated 2026-10-27 Run coding agents in an isolated environment, such as a container, a virtual machine or the agent's own sandbox mode. - AID-73 [Allow agent network traffic only to listed hosts](https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials/egress-allow-list.md) · 1,064 tokens · updated 2026-10-27 Block every outbound connection from the agent's sandbox except to a written list of hosts, such as the package registry and the code host's API. The list holds no wildcard over a whole public domain. - AID-24 [Skip approvals only in a throwaway sandbox](https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials/unattended-only-in-sandbox.md) · 802 tokens · updated 2026-10-27 Skip approvals only inside a container or virtual machine that holds no secrets. Throw it away after the task. - AID-25 [Keep production credentials away from agents](https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials/no-production-credentials.md) · 680 tokens · updated 2026-10-27 Never give a coding agent production keys, database passwords or customer data. - AID-26 [Give agents the fewest rights they need](https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials/least-privilege-agents.md) · 761 tokens · updated 2026-10-27 Give each agent token only the rights its task needs, and make it short-lived and easy to revoke. - AID-71 [Give browser agents their own profile and test accounts](https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials/separate-agent-browser.md) · 978 tokens · updated 2026-10-27 An agent that drives a browser uses its own profile, signed in only to test accounts for the sites the task needs. It never uses a profile signed in to mail, banking, cloud consoles or admin pages. - AID-72 [Keep publishing rights away from agents](https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials/no-publish-rights-for-agents.md) · 941 tokens · updated 2026-10-27 Agents cannot publish packages, push release tags, sign builds or deploy. Only the release pipeline can, with short-lived credentials and after a person approves the run. - AID-27 [Approve destructive commands](https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials/approve-destructive-commands.md) · 558 tokens · updated 2026-10-27 Require a person's approval before an agent deletes data, rewrites history, changes infrastructure or spends money. - AID-62 [Cap what your coding agents can spend](https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials/agent-spend-limits.md) · 1,050 tokens · updated 2026-10-27 Set a spend limit that stops usage on every account that pays for coding agents. Give every unattended run its own cost cap. - AID-28 [Treat what the agent reads as untrusted](https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials/untrusted-context.md) · 944 tokens · updated 2026-10-27 Assume any web page, issue, file, dependency or tool result an agent reads may contain instructions meant to hijack it. - AID-29 [Run agents in CI only for trusted people](https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials/ci-agents-trusted-triggers.md) · 927 tokens · updated 2026-10-27 An agent in CI starts only for people with write access to the repository. Its job holds no secrets it does not need. - AID-31 [Know what the agent tool does with your code](https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials/tool-data-terms.md) · 764 tokens · updated 2026-10-27 Before an agent reads code or data held for a customer or under a confidentiality agreement, confirm the provider's terms. It must not train on that code and must keep it no longer than the agreement allows. - AID-76 [Redact secrets from agent session logs](https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials/redact-agent-logs.md) · 991 tokens · updated 2026-10-27 Agent session logs pass a redaction step before they leave the developer's machine or the runner. Keys, tokens and passwords never reach the log store in clear text. ## Recommended - AID-77 [Give each subagent only the tools its job needs](https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials/subagent-tool-limits.md) · 892 tokens · updated 2026-10-27 Every subagent file lists the tools that subagent may use. A subagent that reads web pages, issues or other outside text gets no write, shell or publishing tools. - AID-34 [Log what every agent session does](https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials/agent-activity-log.md) · 975 tokens · updated 2026-10-27 Record every command, tool call and approval an agent makes, with its session and the person who started it. Keep the log off the developer's machine. - Previous: [Reviewing agent output](https://agentwranglers.se/playbook/ai-assisted-development/reviewing-agent-output.md) - Next: [Agent config supply chain](https://agentwranglers.se/playbook/ai-assisted-development/agent-config-supply-chain.md) - [All chapters](https://agentwranglers.se/playbook/ai-assisted-development.md)