Treat any coding agent that stores credentials as part of your identity plane…

Treat any coding agent that stores credentials as part of your identity plane, not a chat toy: make the trust boundary explicit and operational before you grant tokens. The OpenCode breach (affecting 1.4% of Console users) shows agents can hold real credentials, so you should issue short-lived, scoped credentials fronted by a broker, log sessions, and cap blast radius the same way you would for other privileged automation.