I gave an agent real credentials this week. They came with a task and a time limit.
Most of the fear around agentic AI is really a scoping problem. Hand an agent a login with no boundary and no expiration, and you've built a liability, not a tool.
I've been building something I call the delegate class. I give it a task in plain English — no permissions list, no design doc — and it works out what access it needs, deploys a throwaway remote host built just for that job, does the work, and tears itself down the moment it's done. This week I proved the whole loop live: I said prove it, and the system picked calendar cleanup as the task to demonstrate on — spun up a bare AWS Lightsail box, found the duplicate events, deleted them, logged what it did, and the box was gone.
The part that actually does the work never touches the credential. It has no network access of its own — none at all. It asks a broker, over a local socket, for exactly the two things this task is allowed to do; the broker is the only process on the box that holds the token and the only one that can reach the outside world. The credential doesn't travel — it stays put, and gets used on request.
For that one — and every one since — I see the exact price and say yes before the script builds anything. Every step writes its own audit log. Afterward I checked the real spend against monitoring I'd already set up myself, rather than taking the run's word for it.
The habit isn't limited to one-off tasks. This week I also stood up a fully hardened, general-purpose host on Lightsail the same way — provisioned, hardened at boot, verified — and tore it down when I was done with it. A second one, same build, is live on Hetzner right now: this one I'm keeping.
That's the pattern I'd want in any regulated enterprise rolling out agents at scale — least privilege, a hard time limit, fails closed instead of open. And I didn't design that scope myself. I said what I wanted done; the system worked out what it needed to touch and for how long — inside guardrails that don't move task to task: a fixed list of what it can never reach (my master keys, my other machines, another job's credentials), a hardening baseline applied the same way every time, and a teardown order that's non-negotiable. I signed off on the result, not the process.
That's the part that actually scales: name the task, let the system design its own access, build exactly what the job needs, run it, and tear itself down when it's done. This week that loop ran for real, against a real calendar, start to finish, with nobody hand-configuring anything in the middle. Doing that every time, for anything I name, without watching each run — that's the difference between a home lab test run and on-call coverage a two-person shop could actually run.
Scope the credential right, and the model barely matters.
Both patterns are skills on my own machine now, not one-off scripts — /hetzner-box, /lightsail-box. They'll ship in ai-os-seed soon, with full setup instructions for each hosting platform, so installing it gets you the same thing.