Your Coding Agent Should Never Hold a Credential

Your coding agent should never hold a credential, and in a software factory that rule is only the start. Recorded live at the AI Security Summit in San Francisco, Simon Maple sits down with Eli Aleyner (Docker), Marcelo Sousa (Snyk) and Ian Livingstone (Keycard), co-authors of Agent Baseline, a security reference architecture for the AI software factory. The panel unpacks why agents have to be treated as fundamentally unpredictable actors, why sandboxing alone is not enough when skills and MCP servers make the supply chain dynamic, and why approval prompts collapse into fatigue. Marcelo's verdict: sometimes these are kids with chainsaws. What we cover: – The three levels of autonomy, from coding agents to fully agent-directed workflows – Sandboxing coding agents and injecting secrets at the egress point – Why the agent supply chain is dynamic: skills, MCP servers and cloned repos – Prompt injection, least privilege and agents monitoring other agents in the harness – Approval fatigue: YOLO mode vs CYA mode – Where to start securing your software factory on Monday morning Chapters: 00:00:00 - Introduction 00:03:14 - What Agent Baseline is and who it's for 00:04:17 - The three levels of software factory autonomy 00:06:53 - Sandbox boundaries and manufacturing trust in agents 00:09:22 - Why coding agents should never hold credentials 00:11:44 - The dynamic agent supply chain: skills and MCP servers 00:14:57 - Untrusted input, least privilege and agents watching agents 00:18:02 - Approval fatigue: YOLO mode vs CYA mode 00:20:22 - Are poisoned agent skills a supply chain problem? 00:22:45 - Where the panel disagreed, and where to start Monday Build your software factory, one workflow at a time, with Tessl: https://tessl.co/gsh 🔔 Subscribe for weekly episodes on AI-native development Which level of the software factory are you at today, and what are you locking down first? Tell us in the comments.