Rollout — what to prepare
The three lists, three connections and four installs a customer prepares before deployment, and exactly where coverage stops.
For the team deploying damn.dev. Read this before the first install. It takes about ninety minutes of your time and it decides how much of your estate you actually end up covering.
damn.dev runs on your own infrastructure. Nothing you list here leaves it, and we never see the values behind any credential you connect.
Why there is homework at all#
A scanner finds AI tools installed on machines you manage. That is a real answer and it is not the whole answer, because three things are invisible to any product in this category:
- a tool running in a vendor's cloud, configured inside that vendor's console
- a credential sitting in a password manager we have not been shown
- a personal account, on a personal device, against a public service
The first two you can close in an afternoon. The third nobody can close, and any vendor telling you otherwise is selling you a dashboard.
So: three lists you write, three connections you grant, four things you install.
Three lists#
Ninety minutes with a whiteboard. None of it is technical.
1. Tools#
Every AI tool in use — especially the ones that live in somebody else's cloud, because the scan cannot see those and only you know they exist.
Include: ChatGPT (Team or Enterprise), Copilot, Gemini, Claude, Cursor, Codex, Windsurf, Devin, Dust, custom GPTs and GPT actions, AI steps inside Zapier, n8n or Make, anything a vendor has quietly added to a SaaS product you already pay for.
Do not filter for what is "approved". The unapproved ones are the point.
2. Systems#
The systems that matter, ranked by a single question:
Which of these would ruin your week if an agent touched it?
Typically ten to fifteen: production database, git host, payment provider, CRM, data warehouse, file storage, internal APIs, customer support desk.
Not a full asset inventory. If the list is long, it is wrong.
3. Owners#
A name against every tool and every system. One human being, not a team.
Where you cannot write a name, leave it blank. The blanks are the most useful output of this exercise — an agent with no owner is the thing nobody is going to notice.
Three connections#
Read-only. We read inventories: which secrets exist and who can reach them. We never read the values.
1. Your password manager or secret store#
1Password, HashiCorp Vault, AWS Secrets Manager, Doppler, or whatever holds your credentials today.
What this gives you: the list of every credential and who can resolve it — which is how you find doors nobody has walked through yet. A credential that exists is a door that exists, whether or not an agent has used it.
What you grant: a read-only service account scoped to listing items and their access grants.
2. Your identity provider#
Okta, Entra, Google Workspace.
What this gives you: which applications exist and who has them, so an AI tool nobody declared still shows up as an app somebody is signing into.
What you grant: read access to the application and user directory.
3. A model-provider admin credential#
OpenRouter Management key, OpenAI admin key, or Anthropic admin key, depending on what you use.
What this gives you: the ability to issue one credential per agent instead of one shared key across everything. This is the only connection that unlocks per-agent cost, per-agent revocation, and per-agent spend limits.
Scope these carefully — The OpenAI and Anthropic admin credentials administer keys across your whole organisation, well beyond agents we run. OpenRouter's Management key is narrow and cannot make model calls.
Optional — Without it you still get discovery, the record and gating at the systems you control. You do not get spend enforcement or one-action revocation.
Four installs#
| What | Where | Who does it |
|---|---|---|
| The server | A VPS or an on-prem box you own, with a domain and TLS | Platform engineer, one afternoon |
| Endpoint sensor | Employee machines, via install link or MDM | Per person, or pushed |
| Browser extension | Chrome, individually or force-installed via Google Admin | Per person, or pushed |
| Coding-agent config | One line in each developer's Claude Code, Codex or Cursor config | One command, per machine |
Nothing here phones home. The server is yours; the sensor and the extension report only to it.
The sequence#
Week 1 — see#
The scan runs, your three lists arrive, the three connections come online.
Output: what exists, who owns it, and what each credential can reach. Nothing is enforced and nothing is blocked. Expect the inventory to be larger than anyone on your side predicted — that is the normal result, not a bad sign.
Week 2 — scope#
Take the five systems at the top of your ranked list. For each one, replace the shared credential with per-person, per-agent credentials that expire.
This is the week that closes the hole you cannot observe. Once a database credential belongs to one named agent rather than to everybody, a colleague cannot paste it into a chat window — there is nothing for them to paste. And if the named one is misused, it has a name on it and dies in one click.
Weeks 3–4 — gate#
Turn on rules for the doors you sit at, in observation mode first: nothing is blocked, everything is recorded, and you see what would have been stopped.
When the rules look right, switch them to enforcing.
What you get, and where it stops#
We are exact about this on every screen, and you should hold us to it.
| What it means | |
|---|---|
| Detected | We know the tool is there. We never see what it did. |
| Observed | We see the actions, on a tamper-evident record. Not stopped. |
| Gated | The action is decided before it happens — enforced where you own the credential or the system, best-effort where it relies on a hook inside somebody else's tool. |
| Contained | The environment physically cannot reach what you did not allow. Only for agents we launch in a locked environment. |
Without the three lists, you cover what we can observe, and vendor-cloud tools stay invisible.
Without the three connections, you can see but you cannot act — no spend limits, no one-action revocation, no map of untouched doors.
Ceiling — Even with everything connected, a personal account on a personal device against a public service is detected at best. That is true of every product in this category. The difference is that we label it on the screen rather than folding it into a number.