Danielle Morrill describes eight Claude Code sessions using this arrangement across her machines, with 1Password as the source of truth and a separate read-only service account per Mac scoped to selected shared vaults. These observed facts describe one operator's setup, not a tested general product feature.
The mechanism: A per-machine read-only service account accesses scoped 1Password vaults; scripts retrieve credentials from the macOS login keychain without exposing them in chat transcripts. Morrill also reports verifying each credential with an authenticated call, because a successful seeding command or token length did not establish that a credential worked. The implication: Secrets can be kept out of agent transcripts while per-machine tokens permit granular revocation. The boundary is consequential: any process running as the same user can read credentials already cached in that keychain.
Why now: Agents that perform deploys and other production work need credentials, so reducing manual secret handling makes the access boundary an operational design choice. The evidence boundary: This is a first-person account of one configuration, not an independent security assessment or evidence that all agent environments behave alike. What to watch: Whether future agent runtimes offer a narrower per-action credential gate than a shared user-level keychain. Morrill's setup makes the tradeoff visible; it does not establish that the tradeoff is safe for every threat model.