# Agent credential boundary inventory

This manual worksheet records authority and ownership, not secret values. It does not change access or prove that an agent is contained. Direct provider credentials and tools can bypass Gated; project skills do not automatically intercept them.

**Keep private:** use an approved team location. Never include tokens, secret values, private keys, authorization headers, or credential-store exports. Use non-sensitive labels. Redact repository identifiers, people, configuration details, and evidence links before external sharing.

## Environment under review

- Review date: __________
- Runtime or agent environment: __________
- Inventory owner: __________
- Selected non-critical pilot repository: __________
- Intended controlled route: __________

## Repeat for each authority route

- Non-sensitive credential or connection label: __________
- Provider and credential type: __________
- Owner responsible for the credential: __________
- Where the agent can reach it: __________
- Repository selection or provider scope, as verified by owner: __________
- Expiration or lifecycle information, if known: __________
- Direct provider access, controlled Gated route, or unknown: __________
- Required for this pilot: yes / no / unknown
- Evidence location (private reference): __________
- Observation date and environment: __________

Consider configured connections, environment variable names, local tools, credential helpers, and jobs that can act on the agent's behalf. Also inspect repository automation that branch creation may trigger. Do not copy secrets to demonstrate availability.

## Disposition

- Alternate route remains available: yes / no / unknown
- Consequence for pilot conclusions: __________
- Action agreed with credential owner: __________
- Owner and follow-up date: __________
- Configuration change that will trigger another review: __________

Do not revoke shared credentials solely because they appear here. Coordinate any change with their owner through the team's normal process. An unexplained route remains an open question, not evidence of absence. The Gated pilot covers one exact branch creation, not every action the agent could take.