## TL;DR

Staging and production secrets get confused when they share names and stores. Separate them by store or by strict naming, label every secret with its environment, and make the agent check the label before acting.

## Error

```text
agent failed to distinguish the staging secret from the production one
```

## Steps

1. Audit where staging and production secrets live; shared stores are the risk. Expected: the confusion surface mapped.
2. Separate them: different stores, or strict naming prefixes per environment. Expected: structural separation.
3. Label every secret with its environment as metadata. Expected: machine-checkable context.
4. Make the agent assert the environment label matches its intended target before any action. Expected: the check in the loop.
5. Test with a staging-only run and confirm production is untouched. Expected: proven separation.

## When to use

- Agents confusing staging and production secrets.
- Designing environment separation.

## When not to use

- Rotation mechanics failing.
- Single-environment setups.

## Tool compatibility

- Secret managers with metadata and separate stores.

## Variant phrasings

### staging vs prod secret confusion

Separate and label.

### agent used wrong environment secret

Assert labels.

## Why it happens

Identical names across environments plus one shared store make the wrong choice easy and invisible.

## Edge cases

- Disaster-recovery copies blur the line; label those too.
- The agent's own config must name its environment explicitly.
- Separation must survive refactors; test it in CI.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_lEL1K0mw5vzPsz9zaDN2yQ