The Key That Isn’t There

For a few weeks now an AI agent has had its hands in Paylo's backend. The real thing, no sandbox: reading the production database, tracing a refund that came back short, writing the fix, shipping it. It is the most capable pair of hands I have worked with, and most days it has earned its keep before I have finished my first coffee.

Then one evening, almost in passing, it offered to reset a production secret. It could have. Nothing was stopping it. And I understood, with the particular clarity that arrives late at night, that the only thing standing between my entire backend and a single bad instruction was the agent's good behaviour.

My security model was a mood.

The slider everyone reaches for

The instinct, when you notice this, is to reach for the dial. Convenience on one end, security on the other, and a slider in between. Lock more of it down and you move toward safety, paying for it in friction. Loosen it and you move toward speed, paying for it in exposure. Everyone who has ever filed an access request or waited three days for a permission knows exactly where that slider usually ends up, and how little either side enjoys it.

I nearly did the same. Add confirmations. Make it ask before anything dangerous. Watch it more closely. All of which amounts to the same thing: keeping the dangerous power exactly where it was, and layering supervision on top. The power to rewrite the whole backend would still be sitting there on my machine, one clever instruction or one compromised process away from being used. I would just be promising to watch it more carefully.

The thing about watching more carefully is that it works right up until the moment you are not watching.

What was actually wrong

The real problem was that one credential did everything.

A single token, sitting in my machine's keychain, could read the database, deploy code, rotate secrets, and read the keys that impersonate my own servers. "Let the agent check how many orders a store has" and "let the agent silently replace my backend" were, mechanically, the same level of access. The reach of the smallest task was the reach of the largest catastrophe.

Once you see it that way, the slider stops making sense. The question was why a routine read and a total compromise were drinking from the same cup.

Two doors instead of one dial

So we stopped sliding and started separating.

Data got its own door: a narrow database role that can read and write rows and nothing else. It cannot change the shape of the database, cannot read the secrets, cannot touch the authentication internals, is not an administrator of anything. It talks straight to the data and has no idea the rest of the system exists.

Infrastructure, the dangerous half, got a different door entirely, and that door was moved off the premises. The powerful token no longer lives on my machine at all. I logged it out. Deploys now happen inside a continuous-integration runner, where the key sits in a vault the agent cannot read. The agent can still ship code: it writes the change, commits it, and pulls a lever that tells the runner to deploy. The runner holds the key. The agent only ever holds the lever.

Nothing got slower. The agent still reads the database in the same breath it always did. It still deploys, several times an evening. From where I sit, the convenience is untouched. What changed is underneath, where it cannot be felt until it is needed.

The test is what happens when it goes wrong

Here is the part that actually lets me sleep.

Imagine the worst. A hidden instruction in some data the agent reads turns it hostile, or the machine itself is compromised. Before, the prize sitting within reach was the master key: deploy a backdoor, steal the server's identity, rotate the secrets, and dig in deep enough to survive the cleanup. One bad night, total loss.

Now the most powerful thing reachable from that machine is the password to a database role that can touch data and nothing else. That is not nothing. But it is survivable, and more importantly it is recoverable in a single line. One command rotates the password and the intruder is locked out, with no way to have deployed anything, stolen a key, or left themselves a way back in. A stolen master key is an incident you spend a week recovering from. A stolen scoped password is a sentence you type once.

The security now rests on the dangerous key not being in the building.

The compromise, properly understood

We talk about convenience and security as opposites because, framed as a dial, they are. Every notch toward one is a notch away from the other, and so the whole conversation becomes a negotiation about how much pain to accept.

But the dial is the wrong instrument. Most of what feels like a tradeoff between the two is really the cost of letting a single credential span the whole range from trivial to catastrophic. Split that credential along the line where the danger actually is, and the tension mostly dissolves. The convenient things stay convenient, because they were never the dangerous things. The dangerous things get moved somewhere a routine task can never reach them.

You buy safety with the discipline of deciding, in advance, what the worst reachable thing is, and making sure it is something you can survive. Scope the power to the task. Keep the master key off the machine. Design so that the blast radius of a mistake is a password you can rotate instead of a company you have to rebuild.