diff --git a/docs/adr/0009-in-container-ai-agents.md b/docs/adr/0009-in-container-ai-agents.md
index 1f4d49b2..2d6e0e05 100644
--- a/docs/adr/0009-in-container-ai-agents.md
+++ b/docs/adr/0009-in-container-ai-agents.md
@@ -38,6 +38,28 @@ scope is later and optional (lines 9-21) is amended: in-container agents are wav
 one. The non-goal wording superseded is in `docs/product.md`.
 Nothing here authorizes orchestration, dispatch or board work.
 
+## Open question: agent credentials (design input, not a decision)
+
+Recorded 2026-10-15 as input for the credential design; nothing here is decided.
+
+- Subscription CLIs (Claude Code, Codex, Antigravity) authenticate with an
+  interactive login, not an API key. A model gateway does not cover them; their
+  guardrails need a separate answer.
+- For API-key use, a candidate pattern is an owner-run model gateway outside the
+  workspace. The gateway holds the provider keys; the workspace receives only a
+  base URL and a per-workspace virtual key, which gives budgets and
+  per-workspace attribution without provider keys in the container.
+- A gateway only enforces this if workspace egress to the providers is
+  restricted to the gateway. That needs a network policy in the Docker
+  provider, which is undesigned; no workspace egress policy exists yet.
+- WorkHarbor would expose a provider-neutral seam (gateway URL and key
+  reference) and would not bundle, deploy or configure a gateway.
+- Candidates to evaluate, unverified:
+  [Busbar](https://github.com/GetBusbar/busbar) (self-hosted single binary,
+  six model protocols; its MCP/A2A governance is not yet demonstrated and its
+  config format is outside semver), [LiteLLM Proxy](https://github.com/BerriAI/litellm) and
+  [agentgateway](https://github.com/agentgateway/agentgateway).
+
 ## Consequences
 
 [Product](../product.md) and [architecture](../architecture.md) state the wave-one
@@ -46,4 +68,4 @@ scoped exception needs owner action under its governance and is not made here.
 The session interface contract ([#71](https://github.com/wstein/workharbor-nxt/issues/71)) and its wire format,
 authorization binding and failure behavior are undesigned and belong to a
 feature spec. Credential handling for agent
-subscriptions is open. Nothing is implemented or verified.
+subscriptions is open; see the open question above. Nothing is implemented or verified.