API Key Rotation Needs a Contract First
Select the spec-first move that prevents an AI coding agent from inventing risky product behavior.
Renewal call tomorrow, security workflow today. What should Eli do before asking the AI agent to implement API key rotation? Write a short spec covering admin permissions, old-key overlap, audit logging, non-goals, and required tests, then point the agent at account settings and key management code. Right. This turns hidden security behavior into explicit acceptance criteria and gives the agent a bounded inspection path. Ask the agent to build the UI first so stakeholders can react to the visible flow in the morning demo. Weaker. A UI-first pass can look finished while the dangerous lifecycle rules remain invented or missing.…
Sign up free — one personalized lesson every day, matched to your role and goals.
Already have an account? Sign in