My AI Agents Create Their Own Bug Fixes — But None of Them Have Credentials

In Part 1 , I described the architecture of a fleet of single-purpose AI agents: one job per agent, containerized isolation, cheap LLMs for simple tasks, frontier models for reasoning, append-only logging, and a consistent proxy interface. That's the skeleton. But architecture without security is just organized chaos with good diagrams. Here's a stat that should keep you up at night: according to the State of AI Agent Security 2026 report, 45.6% of teams still use shared API keys for agent-to-agent authentication, and only 14.4% have full security approval for their entire AI agent fleet. We're building autonomous systems and authenticating them like it's 2019. Here's the part that actually matters: how these agents do powerful things — querying sensitive data, creating pull requests, analyzing telemetry — without ever holding dangerous permissions. And how the system improves itself over time without anyone trusting a bot with a merge button. To be precise about "no credentials": no s