{
  "video": {
    "id": "ZUZVNKFSmTM",
    "title": "How Many Credentials Should Your AI Agent Have? Zero. — Jim Clark, Docker",
    "duration": 1093,
    "upload_date": null,
    "channel": "AI Engineer",
    "source": "AI Engineer",
    "event_format": ""
  },
  "analysis": {
    "video_id": "ZUZVNKFSmTM",
    "title": "How Many Credentials Should Your AI Agent Have? Zero. — Jim Clark, Docker",
    "one_liner": "Don't secure the agent harness itself. Secure what flows into it: give each task its own sandbox whose MCP tools, network rules and resources match that task's intent, route all MCP traffic through one gateway, and put zero credentials in any sandbox.",
    "summary": "Jim Clark, an engineer at Docker, argues that agents now run long tasks without supervision, so safety has to come from limiting the blast radius rather than approving each step. The harness is just a loop that takes in context and emits tool calls; the risk is in the tools and context fed to it. His fix is small sandboxes shaped by the task's intent, each with one MCP gateway endpoint that controls which tools, resources and prompts it gets and keeps credentials out entirely. He illustrates this with a newsroom example and his own coding-agent setup, describes cross-app access (XAA) and ID-JAG authorization grants that work with existing company SSO, and points to Docker's `sbx` CLI.",
    "key_points": [
      "Agent harnesses (Claude Code, Codex, OpenCode, Gemini) are simple loops that take in context and emit tool calls. People will keep switching between them, and the harness 'is kind of already sandboxed'. What needs sandboxing is the tools and context flowing into it.",
      "Newsroom example: split one agent into three sandboxes. The researcher gets open web access but no write or publish MCPs and writes to a private temp directory. The fact-checker has no network but can read the research and query a fact database. The reporter has no network but gets the Notion/publisher MCP. No sandbox combines 'crazy unfiltered context' with powerful tools.",
      "Coding-agent example: an hour-long task might need Git signing keys for about 2 minutes to commit. Signing keys should only be in the sandbox when the intent is to commit.",
      "Each Docker sandbox gets a harness plus one MCP gateway endpoint (something like mcp.gateway.docker.internal) that carries all MCP traffic: every resource and every tool call.",
      "The gateway is a control point that decides which tools, resources and prompts each sandbox gets. It also makes harnesses MCP-agnostic, so you don't configure MCPs separately in Codex and Claude Code. The harness becomes a parameter of the sandbox.",
      "Maxim: the right number of credentials inside a sandbox is always zero. With none present, the damage an agent can do is reduced.",
      "XAA (cross-app access, transcribed as 'cross app application'): Docker is partnering on it with two companies the transcript renders as 'Entropic' and 'Octo'. The harness, sandbox and gateway define the agent's identity, exchange identity claims with the company's existing identity provider, and receive an ID-JAG authorization grant, now in the latest MCP spec. That grant gives access to existing OAuth resource servers (Notion, Atlassian, GitHub, Slack) without consent screens, and agent permissions can be administered centrally.",
      "The gateway applies 'progressive disclosure', borrowed from skills, to MCPs: a workflow might use 50 MCPs, but each sandbox doesn't need all 50, which also keeps context size down. An orchestrator's job becomes picking the harness, MCPs, network rules (e.g. api.github.com only, open web, or nothing) and worktrees for each task."
    ],
    "takeaways": [
      "Before giving an agent a task, list the resources and tools it needs, and build a sandbox with only those.",
      "Split workflows into role-separated sandboxes so no single sandbox can both read untrusted web content and use write or publish tools.",
      "Keep credentials out of every harness and sandbox. Route access through an MCP gateway or identity-based grants (XAA/ID-JAG) instead, and add capabilities like signing keys only when the task's intent needs them.",
      "Configure MCPs once at a gateway rather than per harness, so you can swap harnesses freely.",
      "To try the approach, run `brew install sbx`."
    ],
    "topics": [
      "agents",
      "ai safety",
      "sandboxes",
      "mcp",
      "mcp gateway",
      "credentials",
      "identity",
      "containers"
    ],
    "tools": [
      "Docker",
      "Docker sandboxes / sbx",
      "Docker MCP Gateway",
      "Claude Code",
      "Codex",
      "OpenCode",
      "Claude",
      "Gemini",
      "Marp",
      "Mermaid",
      "Neovim",
      "Emacs",
      "Notion",
      "Atlassian",
      "GitHub",
      "Slack",
      "MCP",
      "XAA (cross-app access)",
      "ID-JAG",
      "'Entropic' and 'Octo' (as transcribed)"
    ],
    "quotes": [
      {
        "text": "how many credentials should be in uh a sandbox. Well, I mean the the the right answer is always zero.",
        "at": "12:01",
        "url": "https://www.youtube.com/watch?v=ZUZVNKFSmTM&t=721s"
      },
      {
        "text": "Never have any any creds anywhere in any in any harnesses.",
        "at": "16:37",
        "url": "https://www.youtube.com/watch?v=ZUZVNKFSmTM&t=997s"
      },
      {
        "text": "Give your agents room to solve problems, but let individual sandboxes represent the intent of the task.",
        "at": "14:56",
        "url": "https://www.youtube.com/watch?v=ZUZVNKFSmTM&t=896s"
      },
      {
        "text": "Stick a harness in, stick the MCPs you need in, give it some network rules, Bob's your uncle.",
        "at": "11:43",
        "url": "https://www.youtube.com/watch?v=ZUZVNKFSmTM&t=703s"
      }
    ],
    "words": 3367
  },
  "summary_url": "/#ZUZVNKFSmTM",
  "transcript": {
    "html": "/transcripts/ZUZVNKFSmTM.html",
    "txt": "/transcripts/ZUZVNKFSmTM.txt",
    "vtt": "/transcripts/ZUZVNKFSmTM.vtt"
  }
}