What should a coding agent be allowed to do?

When a coding agent runs inside a project, it often has access to more than the files it actually needs. That can include .env files containing API keys, database credentials, and other sensitive values. But the bigger issue is what the agent can do with the access it inherits. An agent may need to inspect code, install dependencies, call an API, open a pull request, or deploy something—but those actions shouldn’t automatically give it broad access to every environment or service. I’m not sure whether teams are solving this with short-lived credentials, scoped service accounts, a proxy, or something else. How are you handling coding-agent access in practice?