Least privilege for the writing agent

The writing agent gets its own token that opens exactly two routes — read an assignment and submit a draft — instead of the platform-wide cron secret.

What it is

A separate bearer credential accepted only by the assignment desk and the inquiry desk. The shared cron guard still works, so operations and the platform scheduler are unaffected, but the agent's stored configuration holds a credential that cannot reach anything else.

Also called: scoped API token · agent credentials · security for automation

See it
Least privilege for the writing agent
🔒ridgelinepostframe.com/project/blog-a941
Hobby Shop
Framing · on schedule
A privilege diagram: CRON_SECRET reaching every job versus BLOG_AGENT_TOKEN reaching two, with the destructive jobs greyed out. Sample data — no customer information appears here.
How it works
  1. 1blogAgentAuthorized() accepts Authorization: Bearer <BLOG_AGENT_TOKEN>, or falls back to the normal cron authorisation.
  2. 2Only /api/cron/blog-assignment and /api/cron/blog-context use it; every other cron route uses the shared guard alone.
  3. 3A submitted draft still has to clear the publish gate and still lands as a draft, never on the live site.
Why we built it

Written out in full: "LEAST PRIVILEGE FOR THE WRITING AGENT (Keith 08-24). The blog writer is a scheduled Claude Code routine running in Anthropic's cloud, and its credential has to live in the routine's stored config. That rules out CRON_SECRET: the same secret authorizes every /api/cron/* route in this app, including the org-deletion sweep and the billing sweeps. Handing a content agent the key to org deletion because it needs to fetch a keyword is not a trade worth making." And the blast radius is spelled out: "Worst case if the agent token leaks: someone can read published marketing copy and submit a draft, which still has to clear the publish gate… That is a boring blast radius, which is the point."

The problem
  • A single shared secret authorised every scheduled job including destructive ones.
  • An external agent's credential had to be stored outside the platform.
Sound familiar?
What you get
The agent's credential opens two read/write-a-draft routes and nothing else
A leak exposes published marketing copy, not customer data or destructive jobs
Existing operations and scheduling are unchanged

See it on your own jobs

Twenty minutes, your numbers, no slide deck. We’ll build one of your real buildings in front of you and send you the estimate link at the end — yours to keep either way.

or keep browsing features →