Most AI agent security failures share the same root cause: credential scope.
The agent gets broad access — production database, email write, social accounts, cloud admin — because scoping takes engineering time and the demo needs to impress.
The secure pattern:
- Read-only research agent
- Human approval queue for all write actions
- Narrow write worker with short-lived, self-revoking credentials
- Immutable audit log that the agent cannot delete or modify
Without this separation, you are not deploying infrastructure. You are deploying a demo with production keys.