Why Does Your AI Agent Have Your Keys?

Two years ago I was copying code from an AI chat window into my editor. That was pretty great. Now I have agents running commands, making commits and calling tools. I don't really write code anymore, but getting here was a journey.

I work in zero trust, so I naturally think about least privilege: what access does this thing actually need? The productivity I get from using AI can't be overstated, but I refuse to let the agent run as me. I can't give it my SSH keys, my GitHub token, and the like. I found myself building increasingly strict and complex hooks to stop it from doing what I didn't authorize.

This talk follows my attempts to put better boundaries around that access: hooks that blocked too much, a separate Windows account launched with runas, and Git rules that let agents commit without letting them push. I'll compare hooks in Claude Code, Codex and OpenCode, including how mine grew into sounds, tab titles and alerts. I'll also show how MCP Gateway, built on OpenZiti, lets agents reach tools without exposing them to the public internet. Expect things that broke, guards that missed, and the daily annoyances of giving your agent its own account. You'll leave knowing how to give your agent its own account, which hooks are worth writing, and what it costs you day to day. I'm on Windows, but the ideas carry over to macOS and Linux.