You share an agent workflow safely by sending the method and never the keys. In Rote the method is a Play, it travels as a URI, and the Play names the credentials it needs without containing them. The teammate inspects the Play, supplies their own credentials, and runs it on their own machine under a write guard they control.
Most ways of sharing agent work fail one of two tests. A pasted transcript or prompt shares the intent but not a method that runs. An exported script shares a method but often carries a token, a base URL for one tenant, or a write nobody declared. A Play passes both tests by construction.
What travels and what stays
The table separates what a Play URI carries from what remains on each runner's machine.
| Travels with the Play URI | Stays on the runner's machine |
|---|---|
| The recorded step graph | Every credential, encrypted with a machine-bound key |
| Typed inputs and their defaults | The runner's own workspace and trace |
| The read/write contract: which services it reads, which it may write | The write-guard setting that allows, audits, confirms, or denies each write |
| Credentials named by service, never by value | The tenant-specific base URL, if the API is multi-tenant |
| The API fingerprint and version | The decision to run at all |
Rote turns a successful agent run into an inspectable, repeatable Play that can travel across harnesses, models, machines, and teams. The teammate does not need the same harness: a Play recorded in Claude Code runs from Codex, Cursor, Kimi, Hermes, OpenCode, or DeepSeek Harness.
How to share a Play in three commands
The author releases the Play, pushes it to the registry, and sends the URI. The example uses an organization namespace so the Play stays with the team when people change roles.
rote play release weekly-pipeline-report
rote registry play push ./weekly-pipeline-report acme --private
# send: https://play.modiqo.ai/acme/weekly-pipeline-reportA private Play resolves only for members of the organization. A public Play resolves for anyone. Nothing becomes public by default. To share a private Play with one person outside the organization, mint a share link instead of changing visibility:
rote play share create acme/weekly-pipeline-report --audience users --user jordan --expires-in 7dThe link is shown once, at creation, and cannot be recovered later.
Teammates do not have to wait for a message. $play what's new in their harness lists the Plays their organizations published since they last looked.
How the recipient inspects before running
Inspection comes before approval, and a search match is not permission to run. The recipient reads the Play card: version, inputs, the services it touches, the writes it declares, and the credentials it needs by name.
rote play inspect https://play.modiqo.ai/acme/weekly-pipeline-reportFrom the sidekick the same card appears when the teammate asks $play run the weekly pipeline report. Choosing the result is not approval; running is a separate confirmation.
If the Play needs a service the recipient has not connected, Rote names the service and points at its token page. The recipient adds their own key once. The author's key was never involved.
The write guard is the recipient's, not the author's
A Play declares which writes it may perform. The recipient's machine enforces that declaration with a four-tier write guard: allow, audit, confirm, or deny. Rote stops and records any attempted write outside the declared contract. The author cannot loosen the recipient's guard, and the recipient can tighten it below what the author declared.
Every run lands in the runner's own trace
When the teammate runs the Play, the result and its full trace land in their workspace, not the author's. The author sees that a run happened; the author never sees the recipient's data. The recipient now holds their own evidence of what the Play did and can crystallize a variant of it.
rote play run https://play.modiqo.ai/acme/weekly-pipeline-report week=34Organization ownership survives a departure
A Play can be owned by a person or by an organization. Personal Plays stay with the person when they change companies. Organization-owned Plays stay with the organization when a member leaves. Authorship remains visible in both cases, so credit and continuity do not compete.
Questions people ask
Can I share a Play with someone who does not have Rote installed?
Yes. The URI resolves to a page that shows what the Play does, which services it touches, and what the recipient must supply. Running it needs Rote on the recipient's machine.
Does the author see the recipient's results?
No. Runs land in the recipient's own workspace. The registry records that a run occurred, not what it returned.
What if the recipient's API tenant has a different host?
The recipient points their adapter at their own base URL with rote adapter set <adapter> base_url <url>. The fingerprint identifies the API contract, not the host, so the Play keeps working.
Can a shared Play run a destructive shell command?
Only if the Play declares it, and only if the recipient's write guard allows it. Rote stops undeclared or denied writes before they spawn and records the attempt.
This essay is one of five on turning a run into a reusable procedure
Start with the overview, How a successful AI agent run becomes a reusable procedure. The other essays each take one question further:
- Agent skills, workflows, prompts, and Plays remember different things: which container to use for what must survive the next run.
- How to extract a reusable procedure from an agent trace: the five compile operations and the four conditions that block them.
- Agent procedure memory survives a model change only as a program: why a Play runs from any model and stops when the API drifts.
Install the Play sidekick and try this on your own agent
One command installs the Play sidekick, installs Rote when it is missing, and wires the skill into the agent apps it finds on your machine. It runs on macOS and Linux, and on Windows inside WSL2.
curl -fsSL https://getrote.dev/playoffs/install.sh | shRestart your agent app, type $play (or /play in Claude Code), and run the Hello Play. It uses public data, needs no credentials, and declares no writes.
Send the URI, not the script
The next time a teammate asks how you got an agent to do something, send the Play URI. They can read it, run it with their own keys, and keep their own record. Your credentials never leave your machine.