Credential custody
Keep environment-owned credentials behind capability calls.
Agents should receive task-shaped authority instead of broad OAuth tokens, PATs, API keys, or internal API secrets.
Security review
Review the boundary before you trust the boundary.
A clear boundary helps teams decide which credentials belong behind ExecWarden and which risks stay with the execution environment.
Run evidence
Record what mattered after the action.
Transcripts, activity records, approvals, provider results, and command output help reviewers understand what happened.
No theater
Avoid impossible guarantees.
Approvals do not remove the need to review scopes. Sandboxes are not risk-free. Audit records do not prevent all misuse.
Where teams start
Boundary checks worth making before production use.
Boundary
ExecWarden governs mediated capabilities. The execution environment governs what is local.
That distinction matters for security review. It is the difference between a GitHub credential stored only behind ExecWarden policy and a separate token placed directly inside a VM.
Governed by ExecWarden
Agent -> scoped MCP or hosted-session credential -> grant check -> approval if needed -> external system.
Governed by the environment
Files, commands, processes, network access, and secrets independently available in the VM, container, or local machine.
Review the boundary
Decide which credentials should stay behind ExecWarden and which risks stay with the environment.
That separation matters more than any single approval rule or audit view.