Agents that can shell out and browse will eventually do something you didn’t expect. Scope them on purpose.
- One job: write the outcome in one sentence before you open the session.
- One tree: point the agent at a single project directory, not your home folder.
- Least privilege: read-only where you can; no cloud credentials in the workspace; use a throwaway branch.
- Network: deny by default, or allowlist the registries you actually need.
- Review gate: plan mode or a diff review before apply; never auto-commit to main.
- Kill switch: know how to stop the process and revoke the API key you gave it.
If you can’t explain the blast radius in 30 seconds, the agent isn’t ready for that machine.
God Bless, and May the Source Be with You!
