Agent workflows need an impact boundary

In part 1, I wrote about why coding agents should not hold write credentials. GitHub was the example, because the problem is easy to see there. A coding agent can read a repository, reason about a change, and produce useful work. But if the same agent also owns the token that creates branches, commi