Which brings the chapter to its last danger. Everything above is a way for good code to fail. This is a very capable program holding the keys.
Agents and production data
An agent with production credentials can delete data as fast as it can type. So keep credentials it can read away from production, give it a read-only role when it needs to look, and put destructive steps behind something it can't talk its way past. A sentence in its instructions doesn't count.
An agent stuck on a problem looks around for a way through, and a token in a file is a way through. It doesn't feel the difference between staging and production, and it may only find out which one it was in by reading the error afterwards. Instructions are guides, and it can read them and do the other thing.
“You don't get production credentials. Remove any from .env and from every file you can read, and use the local database. If you need to look at production, I'll give you a read-only role. Propose anything destructive as a migration in a pull request. Never run terraform destroy, DROP or DELETE yourself.”