[nojs]

Run the agent in a sandbox without access to production secrets.

[xinbenlv]

What if you simply need to give them access. E.g if you want them to do code review you have to at least give them code repo read access. But you don't know if the environment where agent runs will be compromised

[mejutoco]

If you give read access with their own api key they will only get read access, the access that you gave them. Not sure what is the issue.