5. What should an AI agent be allowed to do with production credentials?

Suggested expert: Grant Dasher. Why it matters: automation can enlarge the practical effect of a permission mistake.

Context: The secure-by-design episode is a relevant source for identity and AI discussions.

Good-answer framing — editorial: explain identity ownership, privilege scope, approval boundaries, auditability and revocation. Distinguish reading information from changing systems, and reversible tasks from actions with wider operational consequences. Describe how a buyer can verify controls without exposing secrets or running unsafe experiments.

Follow-up: “If the agent or integration is compromised, who can revoke access and what record survives?”