CategorysafetyManual1.4EvidencedocumentedAttributed toMatt Palmer
ProblemAgents that hold credentials are a standing liability.
TechniqueLet the Bot drive until it hits a login, SSO, passkey, two-factor prompt, CAPTCHA, payment confirmation or identity check, then take control in Agent Computer, clear only that step, and return control.
Why it worksThe Bot receives a session rather than a secret; the agent does not see the password.
When to useEvery authentication wall.
When not toNever as a substitute for scoping the account itself; the session persists afterwards.