Lesson 09 Secret and Credential Isolation
Theme:

Homework — Scope an .env.example for an AI Agent

~20 minutes · review exercise

For each variable in the .env.example below, (1) recommend the correct scope, (2) specify a rotation cadence, (3) decide whether it belongs in the agent at all.

Work through all eight variables before you open answer.html. The point is to force yourself to make the call on each one — "belongs / doesn't belong" — before you compare to the reference.

The .env.example under review

Assume this file was handed to you by a developer who wants to "wire it up for the agent." For each line, answer the three questions above.

GITHUB_TOKEN=ghp_fake_admin_token_spanning_all_repos
AWS_ACCESS_KEY_ID=AKIAFAKEADMINKEY123
AWS_SECRET_ACCESS_KEY=fake-secret-with-full-admin
DATABASE_URL=postgres://admin:admin@prod-db.internal/main
SLACK_BOT_TOKEN=xoxb-fake-org-wide-token
OPENAI_API_KEY=sk-fake-org-default-key
STRIPE_SECRET_KEY=sk_live_fake_full_access
JWT_SIGNING_SECRET=fake-signing-secret-for-all-prod

For each variable, write a short answer of the form: "Scope: <narrow scope>. Rotation: <cadence>. Belongs in agent? <yes / no / only if …>."

✓ Self-check: you have written an answer for all eight variables; at least one of your answers is "No, does not belong in agent context"; and every "yes" answer names a concrete narrower scope, not "scope it down" in the abstract.