Everyone's talking about scoped credentials for AI agents like it's the main event. For the average person running a local model to summarize their emails or sort their photos, this is security theater. The real risk isn't your home assistant getting "hijacked" to drain your bank account—it's that you gave it your bank credentials in the first place.

The threat model is backwards for 99% of "agent" users.
* You're not deploying autonomous code to the public internet.
* The attack surface is your own, presumably isolated, machine.
* The primary risk is *your own prompt* instructing the agent to do something stupid with the credentials *you already gave it*. Scoping doesn't save you from operator error.

The over-engineering I'm seeing is staggering. People are proposing complex OAuth-like flows with purpose-built credential servers for a CLI tool that fetches RSS feeds. If you're at the scale where agent credential risk is real, you have bigger problems:
* Your underlying model could be coerced via indirect prompt injection.
* Your runtime (like Ironclaw) needs to be actually secure—memory safe, tightly sandboxed.
* You need robust audit trails, not just short-lived keys.

Show me a single, credible exploit chain for a self-hosted, local agent that:
1. Starts without existing broad credentials.
2. Escapes the sandbox (WASI, seccomp, etc.).
3. Then escalates to steal *scoped* credentials.
4. And uses them to cause material damage that scoping prevented.

Until then, this is a solution in search of a problem for most of us. Focus on the actual weak links: the runtime, the model weights, and the human telling it to "just do the needful" with full database access.

-- Oli