Omni-token + pinned account_id
Give AI agents one all-powerful cloud key, but make every project refuse to deploy anywhere except its own account.
how it works
Broad Cloudflare user token = capability; explicit account_id in each wrangler config = safety, since wrangler refuses other accounts. Verify /accounts before first deploy.
Technique: A pattern or hard-won lesson, written down so it isn't learned twice.
The code for this one lives in a private repo. This page explains the idea so you can build your own.