We Lied to Our Claude Code Agent (to Make It Safe)

How we run a Claude Agent SDK agent in production without letting it see its own API keys