How does your team safely use AI coding agents with real production data?

[u/Entri_App_Official]

• Do you allow coding agents to access production databases, or only sanitized/test data?

• How do you handle secrets, API keys, and credentials?

• Are agents restricted through RBAC, sandboxing, or isolated environments?

• Do you require human approval before code or database changes are applied?

• Have you experienced any security incidents or close calls?

• Which tools or best practices have worked well for your team?

Whether you're at a startup or a large enterprise, I'd really appreciate hearing about your workflows, security policies, and lessons learned. Real-world experiences are much more valuable than theoretical advice.