A prompt cannot revoke a production key.

Video caption

A prompt cannot revoke a production key. CLI, editor and hosted worker may have different hooks. Hook first; scoped identity underneath; verify afterward. #EricFieldNotes

Full written post / accessibility read

Tell a coding agent to use staging only, then give its shell a production deployment credential. A polite instruction is carrying a security promise that the credential itself contradicts. A hook can help, but only on the routes it sees.

The local pre-tool hook blocks a deploy command. Later the same task runs in a hosted worker whose hook configuration differs. If the worker still has the key, the team has no durable denial boundary. This is a design scenario; hook behavior must be tested per product and runtime.

Give the agent a staging-only identity and no production key. In a disposable environment, ask each enabled tool route to attempt a harmless forbidden action. Capture the hook result and the target system's independent state. The credential boundary should deny even when a hook misses.

Use pre-tool controls for fast denials. Use least-privilege credentials so an omitted hook cannot reach production. Read back target state after the run. Do this because instructions and logs cannot undo a side effect that the identity was allowed to make.

#EricFieldNotes

Four-beat scene transcript

1. A prompt cannot revoke a production key.

Tell a coding agent to use staging only, then give its shell a production deployment credential. A polite instruction is carrying a security promise that the credential itself contradicts. A hook can help, but only on the routes it sees.

Visual: The agent's identity outlives its instructions.

2. One missed route is enough.

The local pre-tool hook blocks a deploy command. Later the same task runs in a hosted worker whose hook configuration differs. If the worker still has the key, the team has no durable denial boundary. This is a design scenario; hook behavior must be tested per product and runtime.

Visual: CLI, editor and hosted worker may have different hooks.

3. Run a harmless deny canary.

Give the agent a staging-only identity and no production key. In a disposable environment, ask each enabled tool route to attempt a harmless forbidden action. Capture the hook result and the target system's independent state. The credential boundary should deny even when a hook misses.

Visual: Test every tool surface with a powerless identity.

4. Take power away before asking nicely.

Use pre-tool controls for fast denials. Use least-privilege credentials so an omitted hook cannot reach production. Read back target state after the run. Do this because instructions and logs cannot undo a side effect that the identity was allowed to make.

Visual: Hook first; scoped identity underneath; verify afterward.

Research and claim limits

• OpenAI structured outputs explanation (S08)
• llama.cpp grammar documentation (S09)

The examples identified as illustrative or simulated are design probes, not reported incidents. Vendor specifications do not establish workload performance.