--- title: Agents in Production, Part 3: Let Your AI Support Agent... description: Taking the write credential out of an AI support agent and putting it behind DigitalOcean's Action Gateway let about one reply in six go out automatically,... canonical: https://daily.dev/posts/agents-in-production-part-3-let-your-ai-support-agent-send-replies-without-giving-it-the-credenti-uyivrofit twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Agents in Production, Part 3: Let Your AI Support Agent Send Replies, Without Giving It the Credential | daily.dev og:description: Taking the write credential out of an AI support agent and putting it behind DigitalOcean's Action Gateway let about one reply in six go out automatically,... og:url: https://daily.dev/posts/agents-in-production-part-3-let-your-ai-support-agent-send-replies-without-giving-it-the-credenti-uyivrofit og:image: https://api.daily.dev/og/posts/UYIvROFit.png og:image:alt: Agents in Production, Part 3: Let Your AI Support Agent Send Replies, Without Giving It the Credential og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Agents in Production, Part 3: Let Your AI Support Agent Send Replies, Without Giving It the Credential **[DigitalOcean Community](https://daily.dev/sources/do_community)** · 26 min read · 0 upvotes · 0 comments ## Summary Taking the write credential out of an AI support agent and putting it behind DigitalOcean's Action Gateway let about one reply in six go out automatically, with nothing sensitive sent. Across two live runs totaling 335 tickets, 57 went out with no human click, all in the 'product_guidance' and 'dns_configuration' categories. A gateway-level approval rule meant to block risky sends never fired because the agent only calls a generic 'action_invoke' tool, so the real enforcement had to move into the support board's own 'SENDABLE_CATEGORIES' allow-list. The agent also mislabeled 78 drafts as routine (42 'technical_fault', 30 'billing_inquiry'), all caught and refused by the board. A prompt-injection attempt was detected and noted by the agent but still sent since the underlying question was routine; a prompt fix now forces any manipulation attempt to a human. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How do I let an AI agent send replies without giving it API credentials? Move the credential out of the agent and into a gateway that calls the resource on the agent's behalf. DigitalOcean's Action Gateway holds the support board's API key and attaches it to each call outside the sandbox, via credential brokering, so the model only ever sees tool inputs and results, never the secret itself. _Building agent workflows that need safe, credential-free actions is exactly the kind of pattern developers track on daily.dev._ ### Why didn't my gateway-level approval rule on a specific tool name ever trigger? Because the agent calls a generic meta-tool like 'action_invoke' with the inner tool name passed as an argument, a rule matching on the specific tool name such as 'support-board_send_reply' never sees a matching call and silently never fires, even though the platform accepts it as valid. The fix is enforcing the decision inside the target resource's own API instead of the gateway policy layer. _Anyone wiring approval policies for agent tool calls should watch daily.dev for these agent-gateway gotchas._ ### Why does setting permissions.default to 'ask' fail for a scheduled or triggered AI agent run? Headless triggered sessions reject 'ask' as a permission default, with the platform returning 'session_template: permissions.default must be allow or deny (ask is not allowed for headless triggers)'. This is because nobody is present to approve an action during an unattended scheduled run, so 'ask' can never actually stop anything; a 'deny' default with explicit allow rules is required instead. _Developers scheduling unattended agent runs can keep up with these permission-model constraints on daily.dev._ ## Similar posts on daily.dev - [Agents in Production, Part 1: Build an Overnight AI Support Agent using Managed Agents](https://daily.dev/posts/agents-in-production-part-1-build-an-overnight-ai-support-agent-using-managed-agents-7xwjzqxmb) · DigitalOcean Community · 2 upvotes · 1 comments - [Anatomy of an agent incident: three permitted actions, one fraud](https://daily.dev/posts/anatomy-of-an-agent-incident-three-permitted-actions-one-fraud-qxvbehru2) · Arcjet · 1 upvotes · 0 comments - [Your AI Agent Will Do Something Terrible. Here's How to Survive It.](https://daily.dev/posts/your-ai-agent-will-do-something-terrible-here-s-how-to-survive-it--epqotvkt4) · DEV · 3 upvotes · 0 comments - [AI agents are a confused deputy with the keys to your kingdom](https://daily.dev/posts/ai-agents-are-a-confused-deputy-with-the-keys-to-your-kingdom-hdyex7svh) · Stack Overflow Blog · 0 upvotes · 0 comments - [Paper Guardrails: An Inspection Report](https://daily.dev/posts/paper-guardrails-an-inspection-report-ruqsnzxs5) · Medium · 1 upvotes · 0 comments --- Tags: [#ai-agents](https://daily.dev/tags/ai-agents), [#mcp](https://daily.dev/tags/mcp), [#ai-security](https://daily.dev/tags/ai-security), [#digitalocean](https://daily.dev/tags/digitalocean), [#secrets-management](https://daily.dev/tags/secrets-management) [View this post on daily.dev](https://daily.dev/posts/agents-in-production-part-3-let-your-ai-support-agent-send-replies-without-giving-it-the-credenti-uyivrofit) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Agents in Production, Part 3: Let Your AI Support Agent Send Replies, Without Giving It the Credential","url":"https://daily.dev/posts/agents-in-production-part-3-let-your-ai-support-agent-send-replies-without-giving-it-the-credenti-uyivrofit","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/agents-in-production-part-3-let-your-ai-support-agent-send-replies-without-giving-it-the-credenti-uyivrofit"},"datePublished":"2026-10-27T21:35:02.521Z","dateModified":"2026-10-27T21:39:43.388Z","description":"Taking the write credential out of an AI support agent and putting it behind DigitalOcean's Action Gateway let about one reply in six go out automatically,...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/82967395cc5bbf666ffc506c22c291a7?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/82967395cc5bbf666ffc506c22c291a7?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"DigitalOcean Community","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"DigitalOcean Community","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/c1b9d07730e34ea388c39a498a753d6c","url":"https://daily.dev/sources/do_community"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/agents-in-production-part-3-let-your-ai-support-agent-send-replies-without-giving-it-the-credenti-uyivrofit","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"ai-agents,mcp,ai-security,digitalocean,secrets-management","timeRequired":"PT26M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"DigitalOcean Community","item":"https://daily.dev/sources/do_community"},{"@type":"ListItem","position":3,"name":"Agents in Production, Part 3: Let Your AI Support Agent Send Replies, Without Giving It the Credential"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/agents-in-production-part-3-let-your-ai-support-agent-send-replies-without-giving-it-the-credenti-uyivrofit#faq","mainEntity":[{"@type":"Question","name":"How do I let an AI agent send replies without giving it API credentials?","acceptedAnswer":{"@type":"Answer","text":"Move the credential out of the agent and into a gateway that calls the resource on the agent's behalf. DigitalOcean's Action Gateway holds the support board's API key and attaches it to each call outside the sandbox, via credential brokering, so the model only ever sees tool inputs and results, never the secret itself. Building agent workflows that need safe, credential-free actions is exactly the kind of pattern developers track on daily.dev."}},{"@type":"Question","name":"Why didn't my gateway-level approval rule on a specific tool name ever trigger?","acceptedAnswer":{"@type":"Answer","text":"Because the agent calls a generic meta-tool like 'action_invoke' with the inner tool name passed as an argument, a rule matching on the specific tool name such as 'support-board_send_reply' never sees a matching call and silently never fires, even though the platform accepts it as valid. The fix is enforcing the decision inside the target resource's own API instead of the gateway policy layer. Anyone wiring approval policies for agent tool calls should watch daily.dev for these agent-gateway gotchas."}},{"@type":"Question","name":"Why does setting permissions.default to 'ask' fail for a scheduled or triggered AI agent run?","acceptedAnswer":{"@type":"Answer","text":"Headless triggered sessions reject 'ask' as a permission default, with the platform returning 'session_template: permissions.default must be allow or deny (ask is not allowed for headless triggers)'. This is because nobody is present to approve an action during an unattended scheduled run, so 'ask' can never actually stop anything; a 'deny' default with explicit allow rules is required instead. Developers scheduling unattended agent runs can keep up with these permission-model constraints on daily.dev."}}]} ```