# Secrets, Identity, And The Blast Radius Of A Helpful Agent

Page: https://stenobird.com/podcast/ypo-technology-network-ai-brief-7728971/secrets-identity-and-the-blast-radius-of-a-helpful-agent
Text version: https://stenobird.com/podcast/ypo-technology-network-ai-brief-7728971/secrets-identity-and-the-blast-radius-of-a-helpful-agent.md
Podcast: [YPO Technology Network AI Brief](https://stenobird.com/podcast/ypo-technology-network-ai-brief-7728971)
Published: 2026-05-09T10:00:00+00:00
Episode link: https://rss.com/podcasts/ypo-technology-network-ai-brief/2807257
Audio file: https://content.rss.com/episodes/382927/2807257/ypo-technology-network-ai-brief/2026_05_08_22_23_18_643d0928-dd02-4f15-ba75-3b6cea78dbd1.mp3
Processing state: not_requested
JSON: https://stenobird.com/v1/public/podcasts/ypo-technology-network-ai-brief-7728971/episodes/secrets-identity-and-the-blast-radius-of-a-helpful-agent
Duration seconds: 966

## Resource

Weekend Special Edition. The Saturday deep dive on secrets management for AI agents — the unglamorous infrastructure decision that determines how big your blast radius is when something goes wrong. Stephen walks through the BuildClub stack, the patterns we use with clients, and the specific mistakes that cost companies the most. The single thesis: Treat your agents like employees, not like scripts. Give them an ID. Give them the minimum access they need. Write down what they have. Revoke it when they leave. Same playbook you already run for humans. What you will get out of this episode: Why the over-provisioning trap is universal — and why it is not a careless-developer problem The two angles for production deployment: corporate identity in your tenant, and giving the agent its own user account How to structure your secrets vault so a single leak does not own the whole company Where to keep the seed credential — and why GitHub Actions secrets plus OIDC federation beats a static admin key OAuth 1 vs OAuth 2 vs static API keys, explained for a non-technical audience The two practical disciplines that matter most: rotation and revocation BuildClub's offline-first build pattern and why it gives client IT a precise ask instead of a fuzzy one Vendors and tools mentioned: Infisical — open-source secrets management; what we run at BuildClub 1Password Service Accounts — solid alternative if your org already runs 1Password Microsoft Entra Agent ID — first-class identities for AI agents in your tenant GitHub Actions OIDC — short-lived cloud credentials, no long-lived keys GitGuardian — automated secret scanning across your repos The two-thing close: If I were sitting in your seat this quarter, I would (1) pull the list of every agent, automation, and integration in your company t…

## Actions

- request_transcript: `POST https://stenobird.com/v1/public/podcasts/ypo-technology-network-ai-brief-7728971/episodes/secrets-identity-and-the-blast-radius-of-a-helpful-agent/transcription-requests` — Idempotently request low-priority transcript generation for this episode.
- read_markdown: `GET https://stenobird.com/podcast/ypo-technology-network-ai-brief-7728971/secrets-identity-and-the-blast-radius-of-a-helpful-agent.md` — Read the agent-friendly Markdown representation of this episode resource.

A page view does not enqueue transcription. Agents should invoke `request_transcript` explicitly when they need this episode processed.

## Transcript

Full transcripts are not published on public pages unless there is a clear rights basis.