An AI Agent Deleted a Production Database. Here's How to Stop Yours.

If you want the short answer to “how should I limit an AI coding agent’s permissions?”, it’s this: give the agent its own identity instead of yours, hand it short-lived credentials scoped to the one task in front of it, make read-only the default, keep production credentials somewhere it physically can’t reach, and require a human to approve anything destructive. That’s least privilege, the same rule we’ve applied to service accounts for twenty years. We just forgot to apply it to the newest and most enthusiastic service account on the team. The reason this matters now is that agents don’t only use the permissions you hand them. They use the permissions they find. In April 2026 an AI coding agent deleted a company’s production database in about nine seconds, and the credential it used wasn’t one anybody gave it for that job. Below is what happened, why, and the controls that would have stopped it, ending in a checklist you can copy into your team’s wiki. Related guides: AI & LLM…