My AI agent tried to delete my secrets. It couldn't.

A DevSecOps take on scoping AI coding agents by environment. Broad access locally, read-only in prod, guardrails outside the model, and infra fixed through IaC pull requests.