Name them. Watch them. Revoke them.

Every agent gets its own identity. See exactly what it did, when, and why. Pull the plug instantly when you're done.

Share access without sharing the key.

Hand your agent your Stripe or GitHub access. It uses the credential to do work; it never sees the value. The secret stays yours.

Set the rules. They follow them.

Write once: “never spend over $X without asking,” “don’t touch this folder.” Your agent enforces them on every action.

You hold your own keys.

Your sign-in lives on your device, so there is nothing for someone else to steal. Save your recovery code when you sign up and you can restore on a new device anytime.