My wife found a master key hanging on a nail by the door.
Stacy Silva, my lovely wife and cofounder, does QA at a company that builds websites for small businesses. She pointed our agent pipeline at the platform those sites run on, and somewhere between the demo and the paperwork she discovered that the platform issues its API credential agency-wide. One token. Every client site the company manages. Not scoped to a user, not to a role, not to a site. Shewrote the whole story and you should go read it, because it's a better story than mine. Hers has a locked walk-in in it.
I'm not here to retell it. I'm here to tell you the same key is hanging in your shop.
It's easy to laugh at one unserious platform. A multi-tenant system whose entire business is holding other companies' client work, and the access model is a skeleton key. Absurd. Go ahead and laugh. But finish the laugh by looking at your own stack.
The org-wide token behind your MCP server. The admin key your framework's quickstart told you to paste into an env var. The service account your agent runs as, provisioned once, scoped to everything, reviewed by no one. Every agent demo on the internet runs on god mode, because god mode demos great. The nail by the door isn't that platform's access model. It's the industry's default.
And I know the question you're asking about your agents, because everyone asks me the same one. Can we trust the model?
Wrong question.
I run engineering for consumer home lending at a bank, and banks settled this a century ago. Nobody at a bank has ever asked whether a teller is trustworthy enough to hold every key in the building. The question is absurd on its face. On day one you get the entitlements of your role. Exactly those. They're reviewed on a schedule, logged when used, and revoked when you change desks. The wire room stays locked no matter how gifted the intern is. Not because anyone thinks the intern is a thief. Because a system that depends on nobody ever being a thief is not a system.
Which is why smarter models won't save you. You cannot align your way out of an over-scoped key. A model that's right 99.9% of the time, holding a credential that opens everything, is one bad parse away from a headline. And it doesn't take malice to get there. It doesn't even take a jailbreak. It takes an agent doing exactly what it was asked, against the wrong target, with a key that didn't know how to say no.
I've written before that evidence beats trust-me. This is the sibling rule.Scope beats trust-me. An agent that cannot exceed its operator doesn't need to be trusted. It needs to be logged.
Stacy's fix is the whole doctrine in five words: the tool inherits the human.
With the master key off the table, she rebuilt on the one credential her platform actually scopes to a person. The login. Her agent signs in as the reviewer, sees what that person's role allows, touches what their permissions permit, and every action lands in the platform's own audit trail under the operator's own name. Hand it to a contractor and it can do exactly what that contractor could do by hand. Nothing more. She didn't work around the platform. She built the access model it should have shipped.
We build our own platform the same way, because the principle scales. Tenant data is isolated at the database layer, not by politeness. Agents work stations, and a station's credential opens that station. Policy is code they can't override. Budgets get metered before the spend, not explained after it. Every gate event lands in an append-only, hash-chained log, so history doesn't get quietly rewritten by the thing that made it. Agents draft. People decide. No agent anywhere in the system holds a key wider than the gate it's standing at.
None of that is exotic. It's the same architecture every bank hands every human on day one. The only new idea is deciding your agents deserve the same onboarding as your interns.
So stop asking whether you can trust the model. Start asking what the model is holding.
Walk your stack tonight and count the master keys. Every token that opens more than the job in front of it. Every credential provisioned once and reviewed never. Every nail by every door.
The vault doesn't care how clever you are.
Scope the key.