You are forty minutes into a refactor. The agent has read the codebase, you have corrected it twice, it finally understands that the legacy adapter is load-bearing and cannot be deleted. You are close.
Then you hit your usage limit.
Everyone who codes with an AI agent daily has had this moment, and the two obvious responses are both bad.
Wait for the reset. Sometimes correct. But the context you built up is perishable — not the agent's context window, yours. Come back in five hours and you have forgotten which of the three approaches you rejected and why. You will re-litigate a decision you already made.
Hand over your credentials. Someone on your team has quota left. You paste an API key into Slack, or worse, they log into your account. Now you have a shared secret with no audit trail, no scope, and no expiry, sitting in a DM that will still be searchable in two years. Everyone knows this is wrong. Everyone does it anyway, because the alternative is losing the afternoon.
There is a third option, and it is less about tooling than it sounds.
Here is the thing I got wrong for a long time: I assumed handing off AI work was a credentials problem. Solve the auth, and the work flows.
It isn't. I have watched handoffs fail with perfect credentials, and the failure is always the same shape — the person picking it up cannot reconstruct what the task actually is.
The reason is that you never wrote it down. You were talking to an agent conversationally, steering it in small corrections, and the real specification lives in the diff between what you asked for and what you accepted. That is invisible to the next person. They see the prompt and the half-finished branch, and neither one contains the sentence "we decided not to touch the adapter."
So they rediscover it. Usually by breaking it.
After watching enough of these go sideways, I have landed on a minimum. If a task description has these three, someone else can pick it up cold. If it is missing any of them, it will bounce back to you with questions.
1. The goal, in outcome terms. Not "refactor the auth module" — that is an activity, not an outcome. "Auth module should stop making a network call per request; target is one call per session." Now there is something to check against.
2. The constraints, especially the non-obvious ones. This is the one everybody skips, and it is where all the pain is. Every "don't touch X," every "we tried Y and it deadlocks," every "the tests in Z are flaky, ignore them." These live in your head and nowhere else. Write them down or watch someone else find them the hard way.
3. The definition of done. What command do I run? What should it output? If you cannot state this, the task is not ready to hand off — and honestly, it might not be ready for you to work on either.
Here is the template I use. It is deliberately short, because a template nobody fills in is worse than no template:
## Goal
<outcome, stated so it can be checked>
## Constraints
- <thing that must not change, and why>
- <approach already tried and rejected, and why>
## Done when
<command to run, and the output you expect>
## Context
<links: the branch, the issue, the failing CI run>
Thirty seconds to fill in. Saves an hour of back-and-forth.
The auth problem is real, it is just easier than the context problem.
The principle worth internalising: the unit you share should be the task, not the account. A teammate picking up your work should authenticate as themselves, against their own subscription, with a credential scoped to that one task and nothing else.
Concretely, that means scoped and revocable tokens rather than a shared key. A read-only token pinned to a single task cannot exfiltrate your other work, and it expires on its own — which matters because revocation is a step everyone forgets.
If you take one operational habit from this post, take this one: never inline a token in a config file that gets committed. Use environment variable indirection, so the config holds a reference like ${YOUR_TOKEN_ENV_VAR}
rather than the secret itself, and export the actual value from your shell profile, which is not in the repo.
Once a credential reaches a remote branch, deleting the line does nothing — the value is in the history, and rotating is the only real fix.
You can do all of the above with a shared markdown file and some discipline. I did for a while. It works until the team is bigger than about four people, at which point "which tasks are unclaimed" becomes its own problem.
If you want something purpose-built, Wagglet is built around exactly this split — one person documents the task, another claims it and runs it on their own Claude Code or Codex subscription, with per-task scoped credentials rather than a shared account. The docs cover the handoff format and the security model. There is also a raw skill file if you want your agent to read the workflow directly rather than you translating it.
Disclosure: I work on Wagglet. The template above is the part I would defend regardless of what you use to track it — the tooling is genuinely the easy half.
Writing tasks this way made me better at working on them alone.
If I cannot state the definition of done, I do not understand the task yet. That is worth knowing before I spend an hour and my whole quota discovering it. The handoff format turned out to be a thinking tool that happens to also be a handoff format.
Which means the discipline is worth adopting even if you never hand anything to anyone.
What is in your handoff template that I have missed? I am especially curious how people handle the "approaches already rejected" part — that is the one I still write badly.