We let our cloud agents query prod (with OIDC, not secrets)

Formal has implemented OIDC (OpenID Connect) authentication to allow cloud coding agents like Cursor and Devin to access production data and infrastructure without using long-lived secrets. This approach provides auditable, policy-controlled, read-only access through short-lived tokens tied to the agents' own infrastructure identity, while customers can define granular authorization conditions using CEL expressions and OIDC claim fields. The solution aligns with Formal's philosophy of eliminating long-lived secrets from their infrastructure and product.