What is Scoped Credentials?
Governance & ControlAccess tokens issued per environment, per task, and short-lived, instead of one broad service account. The credential equivalent of blast radius: when a token leaks or an agent goes wrong, the damage ends where the scope does.
Why It Matters
The credential is the boundary. Whatever the token permits, the agent can do, regardless of what the policy says or the prompt instructs. The PocketOS incident turned on exactly this: the agent’s Railway token was scoped for “domain operations” and carried the authority to delete production volumes, so a task that should never have touched production reached it in one mutation. No policy layer can compensate for a credential that already contains the capability. If the scope does not include it, the agent cannot exercise it, whatever the model decides.
The Four Scoping Axes
Environment. A staging agent holds a staging-scoped token. The credential cannot name production resources, so cross-environment mistakes become impossible rather than prohibited.
Resource. The token reaches the specific resources the task needs, not the service as a whole.
Verb. A read-only agent gets a read-only token. Mutation rights are issued separately and only where the task requires them.
Lifetime. Tokens are short-lived, so a leaked or lingering credential expires before it becomes an incident, and credential decay cannot accumulate silently.
Where It Breaks
Teams scope by role instead of by task, because role-based access is what IAM tools make easy. “The deployment agent’s service account” becomes a standing credential that any run of that agent can use for anything the role permits. The second break is lifetime: scoped-but-immortal tokens still let the damage accumulate, just within a smaller fence. Scoping and expiry work together; either one alone is half the control.
How Flytebit Handles It
In the systems we ship, credentials are issued per environment, per resource, per verb, with short lifetimes, and the agent never sees a token broader than its task. The PocketOS failure mode is structurally excluded: a staging run physically cannot name a production volume. The full production practice is in Governing Agentic AI, and the engagement version is our AI governance and risk work.