Here it is in one sentence: I tell the agent on my laptop to configure a remote machine for me, and then to go do the actual work THERE, inside tmux, driving a second agent on that remote box. The laptop agent sets it up, the laptop agent uses it, and I never touch the remote machine by hand — besides creating a mundane, unprivileged user and configuring their SSH access. That, plus the occasional sudo command later on, is the only elevated work that box ever sees, and I do it myself. Everything else happens as that user, and it happens through agents.
Now, the rule above all: my sensitive credentials never leave the laptop, and every single operation that needs them requires Touch ID. Root anywhere, my main GitHub account, anything that can do real damage: Touch ID, every time. The agents' SSH key to the remote box is NOT one of those. That key is free; agents can and should use it as they please, and the worst it gets them is a shell as a user with no root. So an agent cannot suddenly open a root session, locally or on that machine. I would have to be here to approve it, and I sure as hell will not approve a surprise. When something on the remote machine does require sudo, I ask my agents to tell me what the commands are, and I run them one by one, manually, after I authenticate with Touch ID.
Then I add a Host entry for the machine to ~/.ssh/config on the laptop, under a random name that I also save under /etc/hosts. So that
ssh something just takes me — or my agent — straight there. The same entry forwards a few ports, so while a session is open I can hit whatever is running on the remote box straight from my laptop. I tell the laptop agent: this machine exists, this is its name, and these ports are yours as long as the connection remains open. The agent manages that connection while we are working together; not me. When the connection closes, the ports go away, but the work does not: it lives in tmux on the remote box, and the next connection picks it right back up. This, by the way, is something I'm thinking of improving over time, but so far it is good enough and it has not let me down.And that's where the human part ends. I already have a skill on my laptop that configures a remote machine and its user, without root, into whatever my agents need: it installs the tools, sets up tmux, and copies the logins that box needs, which means the fenced GitHub account from the next paragraph and my coding-agent subscriptions. What the experiment itself needs are the .env files from the repository, and those are perfectly fine to share; that is the entire point of an isolated remote user. My sensitive credentials never leave the laptop. I use Podman instead of Docker to run tasks there. In a few minutes, from a fresh box, it's a beast.
On those coding-agent subscriptions: yes, I log my own subscriptions into that box. It is still just me using them, through my own agent from another machine, and I've triple-checked that this is within their terms. Having to re-log some of them in every once in a while is a tad annoying, but, quite frankly, it's a low price to pay for the productivity boost and for the overall experience.
GitHub is fenced the same way. The remote machine gets a separate GitHub account that cannot push into anything I consider important — that would require an approval from my laptop, and my Touch ID, via the Passkey / WebAuthn protocol. It can read the repositories I've granted it access to. It can comment, make commits, and open pull requests. That's it. Merging stays with me.