I counted our credentials before hiring my first agent. 285 of them, 5 with a known owner.

I'm building a company that runs on agents instead of employees. First one provisions and deploys VPSs, so it needs real credentials on day one. Before writing any of it I ran an inventory of what we already have. 285 credentials. 180 of them production. 5 that anyone could say who or what actually uses them. Five Cloudflare Super Admin grants with 2FA off, three of them tied to personal Gmail accounts. That's the mess a human org made. Now I want to add something that works at 3am and never forgets a token it created. The part I can't find an answer to anywhere: secrets are in a self-hosted Phase instance, and I don't know whether each agent gets its own workspace or they share one with scoped access. Per-agent is clean at three agents. At thirty it's thirty things to rotate, audit and offboard. Shared is one thing to run until one agent's compromise reads everything in it. Everyone writing about this is a vendor with an identity product. If you actually run agents with production credentials: which way did you go, and at what number of agents did you regret it?