Agent WranglersSafety and permissions Required
Keep production credentials away from agents
Never give a coding agent production keys, database passwords or customer data.
How to do it
Give agents a development or staging environment with its own keys and made-up data. Keep .env files with values out of the project folder the agent can read. Never connect an agent's database or cloud tool, such as an MCP server, to production. Deploy through a pipeline that holds the keys, not through the agent.
How to check
Search the agent's environment variables and readable files for production key prefixes, such as sk_live_, and production host names. None are found.
For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers ai development playbook: https://agentwranglers.se/playbook/ai-assisted-development/safety-and-permissions/no-production-credentials.