Why would you give agents your own tokens instead of creating a new account that's agent specific with appropriately restricted permissions? At least in the latter case, if you muck up the permissions you can still identify what did the work even if it was an overreach by the agent because you mucked up permissions. I don't give my colleagues my credentials to access anything, they get new accounts with their own permissions and, consequently, their own accountability.
If you're foolish enough to give agents permission to act as you, then you're making a novice mistake. I guess this is a good chance to learn, but the right answer is to stop making novice mistakes and do things correctly. Not double down on the mistake by papering over it.
Don't let agents use your computer user account or credentials. They need to have their own. We don't need a platform for protecting against this, we need to use basic security practices, for real.
Why would you give agents your own tokens instead of creating a new account that's agent specific with appropriately restricted permissions? At least in the latter case, if you muck up the permissions you can still identify what did the work even if it was an overreach by the agent because you mucked up permissions. I don't give my colleagues my credentials to access anything, they get new accounts with their own permissions and, consequently, their own accountability.
If you're foolish enough to give agents permission to act as you, then you're making a novice mistake. I guess this is a good chance to learn, but the right answer is to stop making novice mistakes and do things correctly. Not double down on the mistake by papering over it.
Don't let agents use your computer user account or credentials. They need to have their own. We don't need a platform for protecting against this, we need to use basic security practices, for real.
[flagged]
[dead]