Agent Access Provisioning (Onboarding)

Agent Access Provisioning (Onboarding)

1. 01

   Inventory every repository, API spec, and environment the agent will touch before granting credentials

   List repos, OpenAPI or Protobuf specs, staging and production environments, and secret stores. An agent given repo-wide read access can surface client code in prompts and logs, so scope each grant to the minimum path set.

2. 02

   Assign a named human owner per repository who signs off on agent-generated merges

   One engineer per repo, recorded in the client delivery tracker. Ownership must be a person, not a team alias, so review accountability survives staff turnover mid-retainer.

3. 03

   Confirm the vendor's metering, feature-gating, and dispute terms in writing

   Forrester flags that AI application vendors now set usage limits, control feature access, and arbitrate disputes over their own tools. Record who controls pricing and access for each tool in the client file before the first commit.

4. 04

   Run a two-week pilot on a single non-critical repo and label it as a pilot in the client scope

   A pilot answers whether the tool fits the codebase; a prototype answers whether the concept works. Conflating the two is the most common agency scoping error when deploying AI into client environments.

5. 05

   Set a per-session and per-month spend ceiling tied to the retainer's delivery budget

   Parallel agent sessions multiply token and compute cost quickly. Cap both dimensions and route overages to the account lead rather than absorbing them into fixed-fee work.

6. 06

   Configure a review checkpoint before any agent output reaches a client branch

   Pair the agent with a diff-visibility step so a human sees every file, class, and function changed before merge. Treat unreviewed agent commits as a delivery defect, not a speed win.

7. 07

   Document the rollback path and the exit clause for each tool in the stack

   Note export formats, license terms, and how much generated code depends on vendor-specific scaffolding. Vendor lock-in is cheapest to price at onboarding, not at renewal.