Secret rotation automation
Secret rotation at your company is manual, dreaded, and overdue everywhere. Design an agent that drives rotation across services — with one absolute rule you must design around: it never sees a secret in plaintext. How does it verify a rotation actually worked without reading the credential? What can it trigger versus what needs a human? Lay out the evaluation before it touches production credentials, and make the case that automating this reduces risk instead of adding it.
decide_rotation_action(secret_kind: str, canary_auth_passed: bool, old_version_still_used: bool, consumer_error_rate: float, rollback_rehearsed: bool) → str["service",true,false,0.001,true]out"retire_old_version"["service",false,true,0.001,true]out"rollback"["break_glass",true,false,0,true]out"hold_for_human"Turn the fuzzy goal into a bounded agent task. Say what the agent reads, what it may do on its own versus draft for a human, and what it must never touch. Then earn the trust: how you’d verify it before rollout, and the pitch (the problem, what you built, why it matters).
Agent build: design the agent in plain language (or narrate it). The coach grades the decomposition, the guardrails, the verification plan, and the pitch.