An agent that can run commands can run the wrong one. Shrink the blast radius in layers: a sandbox, an allowlist, scoped secrets and a human gate on anything irreversible.
Lesson 19 / 24 · ⏱ 8 min
An agent that can run commands can delete a folder, push a branch or read your credentials file. Usually it won’t. Guardrails are for the day it does.
I don’t rely on the agent behaving. I design the environment so that when it misbehaves, the damage stays small and reversible.
Think in blast radius
No single guardrail is enough. Each layer catches what the previous one missed, and the question for every layer is the same: if the agent gets this wrong, what’s the worst that can happen?
Defence in depth. The agent sits in the middle. Every ring it has to cross to cause damage is a chance to stop it.
Permissions: allow the boring, ask for the rest
Most coding agents let you decide which actions run automatically and which need your approval. The trap is approving everything because the prompts get annoying.
✕ Approval fatigue
–Every command asks, so you click yes without reading
–Eventually you switch approvals off entirely
–The one dangerous command slips through like the others
✓ A deliberate allowlist
+Read files, run tests, run the check command: automatic
+Install packages, touch config, use the network: ask
+Push, deploy, delete outside the repo: blocked
+The few prompts you still see are worth reading
Secrets: assume the agent can read them
If a secret is in the agent’s environment or anywhere it can read, treat it as something that can end up in a log, a commit or a prompt. Keep production credentials out of agent environments entirely.