Isolated identities make it safe
Each agent is its own account with its own permissions on every shared platform.
It works as itself, never through a shared login, so its actions can't collide with another's.
A
Agent A
@agent-a
a@acme.dev
B
Agent B
@agent-b
b@acme.dev
C
Agent C
@agent-c
c@acme.dev
GitHub
repositories
A
B
C
distinct accounts, own permissions
Salesforce
CRM records
A
B
C
distinct accounts, own permissions
Postgres
shared database
A
B
C
distinct accounts, own permissions
Shared credentials and shared workspaces are where it breaks. Distinct ones, with real permissions, are where it works.