---
title: "Keep production credentials away from · Agent Wranglers"
url: https://agentwranglers.se/playbook/ai-assisted-development/safety-and-permissions/no-production-credentials
updated: 2026-10-20
licence: "All rights reserved"
---

# Keep production credentials away from agents

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [Safety and permissions](https://agentwranglers.se/playbook/ai-assisted-development/safety-and-permissions)
- Rule: Never give a coding agent production keys, database passwords or customer data.
- How: Give agents a development or staging environment with its own keys and made-up data. Keep `.env` files with values out of the project folder the agent can read. Never connect an agent's database or cloud tool, such as an MCP server, to production. Deploy through a pipeline that holds the keys, not through the agent.
- Check: Search the agent's environment variables and readable files for production key prefixes, such as `sk_live_`, and production host names. None are found.

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers ai development playbook: https://agentwranglers.se/playbook/ai-assisted-development/safety-and-permissions/no-production-credentials`.

- Previous: [Skip approvals only in a throwaway sandbox](https://agentwranglers.se/playbook/ai-assisted-development/safety-and-permissions/unattended-only-in-sandbox)
- Next: [Give agents the fewest rights they need](https://agentwranglers.se/playbook/ai-assisted-development/safety-and-permissions/least-privilege-agents)
- [Safety and permissions](https://agentwranglers.se/playbook/ai-assisted-development/safety-and-permissions)