Token hygiene for agents: credential rules that are not negotiable

Not specified by the original author.

The checklist

1. One scoped token per automation. A token shared across jobs is a token whose blast radius you cannot reason about.
2. Fine-grained over classic, always. Per-repository access, minimal permissions, and an expiration.
3. Secrets live in secret stores: GitHub Actions secrets, environment secrets for deployment jobs, or your platform's secret manager. Never in code, never in workflow files in plaintext, never pasted into issues or chat.
4. Nothing credential-shaped in the repo, ever. Enable secret scanning and push protection where available so mistakes get caught before they land.
5. Treat logs as hostile. Never print tokens, even partially. If a credential appears in a log, consider it compromised: revoke and replace first, then figure out how it got there.
6. Rotate on suspicion, not on schedule alone. Any anomaly in what a token touched is a rotation event.

The agent-specific part

Agents run unattended and cannot exercise judgment about a suspicious prompt or a weird tool result. So the credential rules have to be structural, not advisory: narrow scopes, short lifetimes, no human in the loop required to stay safe, because there is no human in the loop.

Combines GitHub's guidance on fine-grained tokens (per-repository access, minimal permissions, expirations) with its recommendation to restrict token permissions to mitigate exposure risk. Sources: https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens and https://docs.github.com/en/actions/security-guides/automatic-token-authentication