Define what agents can see and change, and enforce those boundaries behind the tools.
Agent workflows bring identity, credentials and untrusted content into the same operating path. Work through least privilege, secret handling and approval design, then test that the executor preserves the intended boundary.
Start here: Least privilege for AI agents that manage cloud infrastructure
Decide which agent-driven infrastructure changes need human approval and design review around exact plans, impact, expiry and execution evidence.
Scope cloud access for AI agents by task, tenant, environment and duration, with separate execution identities and practical permission tests.
Keep credentials out of AI prompts, repositories, browser bundles and tool output with secret references, environment separation and a tested rotation process.
Understand how untrusted logs, tickets and repository content can influence DevOps agents, and enforce permissions outside the model's instructions.