Make the Agent a Citizen

I asked my agent to do something small this week, and it ran straight into a wall. The wall turned out to be the whole point.

The task was boring on purpose. We’ve got a product — a membership platform a few of us have been building — and it has one of those little “Send Feedback” buttons tucked in the corner. Someone clicks it, types a sentence, and it lands in a table somewhere. I wanted that feedback pulled out of production and turned into real tickets in Linear, so it would actually get looked at instead of quietly piling up. “Go grab the help tickets and file them.” Ten minutes of work, I figured.

It was not ten minutes.

The one-way street

First thing we found: the feedback only ever went in. There was no way to get it back out. Someone had built the button months ago, wired it up to save a row, and stopped there — write-only. The data was sitting in the production database with no door on the other side.

So before anything else, we built the door: a way to read the feedback back, and a way to mark each one as handled once it had been turned into a ticket. Then a little routine to pull from each of our environments and file the results. Straightforward stuff. The kind of plumbing that feels good to lay down.

And then the agent tried to actually reach production, and things got interesting.

The part I didn’t plan for

To read anything from the live system, you have to be an admin. The agent’s idea — and it was a clever one — was to go find the secret the app uses to sign its login tokens, and mint itself an admin token with it. Technically flawless. It would have worked perfectly.

The guardrails stopped it cold. Every single time. You’re reading a production signing key to forge an admin session — blocked. I nudged it through a different way. Blocked. I even watched it write out a little permission rule that would let it do the thing — and the safety layer looked at that and said, in effect, nice try. An agent quietly granting itself permission to read production secrets is exactly the move it exists to stop.

And here’s the thing. It was right. I sat there half-annoyed that I couldn’t get my ten-minute errand done, and half-impressed that the system wouldn’t let me — or my agent — talk it into something dangerous just because the two of us were in a hurry.

The friction was the signal. I just had to slow down enough to read it.

What the wall was actually telling me

It took me a beat. The problem was never that the guardrail was too strict. The problem was the shape of what the agent was trying to do. It was trying to become me. Forge a human’s admin session, walk in wearing my face, and do the work as if it were a person who’d logged in.

That’s the wrong shape.

When a contractor comes to work on my house, I don’t hand them my house key and my alarm code and tell them to go pretend to be me. I give them access to the room they’re working in, for the window of time they need it, and I can take it back the moment the job’s done. Nobody thinks that’s cold. We’ve had a very long time to get comfortable with the idea that access should fit the person and the task — no more, no less.

We just haven’t done it yet for agents. The lazy move — the Era 2 move, if you’ve read my stuff — is to hand the AI a human’s credentials and let it impersonate its way through the work. It works, right up until it doesn’t. And when it doesn’t, it fails in the worst possible way: something with full admin rights, acting as you, with nothing in the record that says it was actually the machine.

Give it its own keys

So the fix isn’t to weaken the guardrail. It’s to stop making the agent pretend to be a person.

You give it its own identity — a key the production system issues to the agent, scoped to exactly what it needs. In this case that’s “read the feedback, mark it handled,” and nothing else. Not admin. Not the members, not the payments, nothing with real blast radius. If that key ever leaks, the worst anyone can do with it is read some feedback and flip a status. You can rotate it, you can revoke it, and you can see precisely when the agent used it — because it’s the agent’s key, and no one else’s.

The moment you do that, the friction vanishes. Not because you switched the alarm off, but because the agent is finally doing something the alarm was never worried about. A scoped key doing scoped work doesn’t trip the wire. That, to me, is the tell that you’ve got the design right: the safe path and the easy path become the same path.

My agent had been treated like an intruder because it was behaving like one — jimmying the lock with the master key. The answer wasn’t to give it a better lockpick. It was to make it a resident. Give it a badge. Let it be a citizen of the system, with the rights a citizen gets and the limits a citizen lives inside.

The part that made me smile

One small thing stuck with me. Once we understood the real problem, I didn’t sit down and architect the fix myself. I described the shape of it — scoped key, least privilege, issued by the system, revocable, auditable — and the agent turned it into a proper plan. A milestone, a stack of tickets, the right order to build them in, what each one has to prove before it’s done. I went from writing the code to reading the plan and nodding at it.

That’s the motto I keep coming back to — automate and elevate. The low work went to the machine. My job moved up a level, to the judgment calls: is this the right design, are these the right limits, is this safe enough to actually trust. And look at what the whole afternoon turned out to be about. Trust. How much of it to extend to a piece of software, how to make that trust specific instead of total, how to take it back if you have to.

I’ve written before that trust is the real infrastructure. I didn’t expect the most literal example of that to be a standoff with my own agent over a signing key. But that’s exactly what it was. The speed of the work is capped by the speed of trust — and you don’t buy more trust by handing over the master key. You buy it the same way you always have: by giving everyone, every person and now every agent, exactly the access their job requires, and not one room more.

The ten-minute task still isn’t done. The scoped-key piece is a stack of tickets, not a shipped thing. But I think I walked away with something more useful than a pile of filed feedback — a clearer picture of what it actually takes to let these things work with us. Not as us. Alongside us.

Make the agent a citizen. Then it can do real work, and you can still sleep.