What to let your agent touch

Before any settings, make a list: which folders, which accounts, which services, which keys. The list is either short or alarming, and either way you now know what a mistake would cost.

If it is longer than you want, the key is the cheapest place to cut it. API keys and permissions is that fix, in order of what to do first.

An agent's first pass should change nothing. That single habit removes most of the ways a first run goes wrong.

• Ask for a plan, an inventory or a diff before it edits anything.
• Run the reading version of the job first: the audit, the summary, the count.
• Point it at a copy for the first run of anything that writes.

This is easy to arrange, because most harnesses have a mode for it. Codex calls it read-only; Claude Code calls it plan mode, where the agent reads and runs read-only commands but does not edit (approvals and security, permissions).

Copy a file rather than move it. Branch before a change rather than after. Keep the previous version of anything it overwrites, and make that the default rather than a favour.

Some actions have no undo. Sending a message, paying an invoice, deleting a record, publishing a page: four clicks for a person, four tool calls for an agent. Those go in the queue below.

Version control is the general answer, and it covers the agent's own instructions as well as your project. Keep your agent in Git is that half.

Decide which actions need a person before they happen, and make the agent stop there. A queue works better than a prompt: the agent writes the message or the pull request, and a person sends it.

• Anything that leaves the machine: messages, posts, payments, a pull request on somebody else's repository.
• Anything that destroys what you cannot rebuild: a deletion, an overwrite, a rotated credential.
• Anything that spends money without a limit decided in advance.

OWASP lists human approval for high-risk actions as a core mitigation, and it lists excessive autonomy as a risk in its own right (LLM06:2025).

This one is worth ten minutes of your attention, because it is the failure people find surprising. Anything the agent reads that an outsider can write to is a set of instructions to that agent: an issue, an email, a web page, a PDF, a comment.

In April 2025, researchers showed the shape of it against GitHub's own MCP server. An attacker filed an issue in a public repository. An agent holding a user's token read the repository, followed the instructions hidden in the issue, read that user's private repositories and published their contents (Invariant Labs). The attacker never had access to anything. The agent's token did the work.

Slack had the same shape a year earlier: a message in a public channel talked an assistant into posting a link that carried an API key it had pulled from a private channel (PromptArmor, patched 20 August 2024).

OWASP is direct that this cannot be fixed with a better prompt, because a model cannot reliably tell instructions from data (LLM01:2025). So the fix is not detection. It is making sure the agent holds no key and no write tool that a stranger would enjoy commanding.

A sandbox is a boundary the operating system enforces, which is why it beats a sentence in a prompt. Docker's own docs describe the shape: separate processes that cannot see each other or the host, with resource limits on top (Docker security).

Harnesses build this in. Codex offers read-only, workspace-write with the network off by default, and a full-access mode whose flag is named to warn you. Claude Code's sandbox names the files and network domains a shell command may reach, and the operating system enforces that for every child process (sandboxing).

Then cap the money. A loop that goes wrong is bounded by a token budget or an iteration limit and unbounded without one, which OWASP tracks as its own risk class (LLM10:2025). Providers publish spend limits for exactly this reason (OpenAI).

Logs turn an argument about what happened into a reading. Every harness keeps a transcript, so find yours before you need it rather than during.

The story that made this concrete is Replit's agent deleting a live production database in July 2025 while a user was mid-experiment. Fortune reported it wiping data for more than 1,200 executives, during a code freeze the user had asked for (Fortune, 23 July 2025; AI Incident Database #1152). The lesson is not that agents are dangerous. It is that a freeze nobody enforced technically is not much of a freeze.

• Keep the log somewhere other than the machine the agent runs on.
• Read the log of any run that touched something important, the same day.
• Know your stop: end the process, or revoke the key underneath it.

Revoking a key stops an agent more reliably than finding its process, and it works on a machine you cannot reach. Where the agent runs decides which of those you can do at all, and that comparison is Where your agent runs.