The Safest Agent Carries a Key That Expires on Its Own

Eleven at night in Nakameguro, the terminal still open, and my agent asks permission to write one row into a staging table. My thumb hovers a beat too long over the admin credential I almost paste in, the one that works on everything, forever, on every table I own, because I have never once bothered to make a smaller one. The cursor just sits there, waiting for me to decide which kind of lazy I am going to be tonight.

Google's own Agent Development Kit team wrote almost exactly this worry down this week: an agent that can mutate production state needs more than a soft system prompt telling it to behave itself. What that means in plain words, stripped of the diagram, is a credential that is not a password working everywhere forever, but a token minted for one job, scoped to one table, with a clock built into it from the moment it is born. Nobody has to remember to revoke it later, at midnight, half asleep. It simply stops being true on a schedule you set once and never touch again.

So last night I did the unglamorous thing instead of the fast one: a ten-line shell function that mints a token good for exactly ten minutes, scoped to the one table the agent needed and nothing beside it, logging every call made against it to a file I can actually read, refusing to run at all if that header is missing from the request. It took fifteen minutes to write and it is uglier, by any aesthetic measure, than simply trusting the agent the way I trusted it an hour earlier. But the night I forget to revoke something by hand is not a special night, marked on a calendar. It is a Tuesday like any other, and a Tuesday is exactly when it happens to everyone who relies on remembering.

I still believe the only honest review of a model is the thing you actually built with it at your own desk, and this week's wire agreed in its own roundabout way — the strongest entries in Google's own internal agents challenge won not on a cleverer prompt but on exactly this kind of plumbing sitting underneath it, the part nobody ever screenshots for a launch post. The real gain this week was not a smarter model arriving from a lab. It was someone, somewhere, finally bothering to set an expiry on something that mattered.

Ten minutes later the token goes quiet on its own, mid-sentence, without ceremony, and the agent asks again, politely, for a new one.