Keep one editable original for each file, document or definition.
| What | Original |
|---|---|
| Factory definition, shared skills and policies | Chosen context home; Notion for our Lab |
| Code, data, models and project documents | The project's own tools |
| Tasks, results, logs and usage | Their existing tracker or agent tool |
| Credentials | Native secret stores |
Exports are versioned snapshots. They do not become a second place to edit the original. Native memory is working context; keep durable decisions and lessons in their owning original.
The Lab’s Notion connection is limited to Factory pages. On 28 October, AgentOps created, read, updated and trashed a disposable page; an excluded page refused both reads and writes. Workers receive selected files, without this connection.
Native permissions enforce the selected pages and operations. They do not enforce the owner's method-change decision: shared Factory changes still need a concrete owner decision or delegation. Project-specific upkeep follows its own mandate. Processes in one environment share its service bindings, even when raw keys are brokered; separate chats do not create an access boundary.
Bind each connection to its project, execution environment, role and permitted operations through native controls. Keep credentials outside context, skills and repositories; record only non-secret references in the Factory definition.
A secret store protects the stored value. A native credential broker can authenticate calls outside the agent environment. Mounted secret files and environment variables give the receiving process the value; they do not establish hidden-key access.
The execution environment contains the agent tool, assigned task/context/skills, tools, and workspace/history. Tools can include CLI and shell commands, file tools, browser and computer use, API/MCP connections, and domain tools for BI, research or defence. Enable only what the task needs. The operator client and remote services may run elsewhere.
Target pattern; verify the execution boundary. Keep upstream permissions narrow: hiding a credential does not reduce its scope. Record expiry, rotation and revocation. Test intended access, an out-of-scope refusal, unreadable raw values, a wrong-environment refusal and withdrawal of access, including cached or global fallback credentials.
Lab status — 27 October 2026: the Z13 pilot used native host-side brokerage with separate model-only workers. Selected access refusals, broker withdrawal and a bounded raw-value scan were observed. Stores remain permission-protected files on the trusted host; this does not establish general isolation or unattended readiness. Evidence and remaining work #32.
Load the assigned skill, its required files and its version. Check that the chosen agent tool actually reads them. In Notion, the lead's scoped connection reads or updates a skill's whole directory, including Files, through the Skills API: back up and compare its version before an update, then read it back. Workers receive the files, not the connection.
For tools that support it, AGENTS.md points to project rules, context and checks. The selected skill defines the role; service and tool permissions control access.