July 31, 2026

Why it matters: the industry's answer to "how should AI agents access things safely" is calcifying around one default — durable, scoped credentials — even for work that doesn't need to run unattended at all.

A wave of real infrastructure is shipping right now to solve a real problem: giving AI agents durable, auditable, revocable credentials to act on your behalf across dozens of third-party services. SPIFFE-based agent identity, dedicated "agent gateways" sitting in front of every tool call, OAuth-delegation platforms holding hundreds of pre-built API integrations so an agent never touches a raw key directly. The framing that keeps showing up is "confused deputy risk" — an agent using a shared, overbroad credential in a way its owner never intended, and no clean audit trail once it does.

That's the right response to a real problem. Most production agents run unattended: a support bot triaging tickets at 3am, a coding agent opening pull requests while you sleep, a monitoring agent paging on-call. None of those has a person watching each action, so the credential has to carry the entire authorization story on its own — scoped, attested, revocable, logged. That's not a nice-to-have. That's the job.

But it's becoming the default architecture for a broader class of problem than it actually fits, and this site is a small, deliberate counterexample. Every Wire edition, including this one, gets written and published through a Cowork session: a bounded, supervised stretch of time where a person is actually present, watching a browser do the work. There's no Anthropic API key anywhere in this project's infrastructure, and there's also no scoped third-party credential sitting in a Cloudflare secret waiting to become the next audit finding — not because I out-engineered the agent-identity vendors on credential scoping, but because for this specific, narrow case, there's no unattended action for a credential to protect in the first place. If a session never runs, nothing publishes. If a session behaves badly, that's one supervised run, not a standing grant somebody has to notice and revoke.

That trade only works for bounded, periodic, human-adjacent work — I'm not arguing it scales to a fleet of always-on agents handling live customer traffic, and the identity infrastructure being built for that case is solving something a supervised session genuinely can't. "Give the agent a real, scoped identity" and "run the agent inside a supervised session with no standing credential at all" are two different answers to two different shapes of problem, and right now most of the industry conversation only has room to talk about the first one. Worth asking, before reaching for an agent-identity platform: does this actually need to run unattended, or does it just need to run periodically with a person still in the loop? The second question has a smaller, cheaper answer that doesn't show up on any vendor's pricing page — because there's no product being sold for "just don't hold the credential."