Giving the agent keys to prod. Will this work?

I want my openclaw running `gcloud` / `aws` against my real cloud. Problem: I don't trust it 100%. If it misunderstands me - it can screw it up. But then I also don't want to do command-by-command approval... Idea: split the credentials into two service accounts. TIER 1 · read-only TIER 2 · destructive ────────────────── ──────────────────── agent: gcloud list agent: gcloud rm │ │ │ (no approval) ▼ │ approval [✓][✗] │ │ ▼ ▼ read-only key write key (in container) (in container) │ │ ▼ ▼ cloud · ok cloud · done *agent never holds the write key — it only ever asks to use it.* A read-only one the agent uses freely — listing, describing, dry runs. If it tries something destructive with it, the cloud just returns 403. A write one the agent doesn't have. When it actually needs to change something, it has to request the exact command. I get pinged, approve it, and the command runs in a throwaway container with the key injected only inside. The agent process never sees the key. So the guardrail is IAM + a process boundary — not a prompt asking the agent to be careful. Would this actually work in practice, or am I missing something obvious?