An AI agent is a language model that doesn't just answer but acts: reading and writing files, running programs, checking results, fixing what failed — in a loop, often for hours. Agents like that work on my websites' code every day, frequently several at once on different tasks. This text, too, was produced in one of those sessions.
That sounds like a loss of control. In practice it works remarkably well — not because I trust the AI the way I'd trust a colleague, but because the environment is built so that mistakes stay small. Four guardrails carry the whole thing.
1. Isolation: every agent gets its own workshop
No agent works on my main copy of the code. Every session gets its own complete working directory — a copy of the workshop where it can hammer and saw without anything wobbling next door. Version control makes this cheap: several working copies, one shared archive.
The effect is twofold. Agents can't trip over each other, even with three running in parallel. And nothing an agent builds becomes "real" on its own: promoting work into the main line is a separate, deliberate step — after I've looked at the results. There's a strict house rule attached: an appreciative "looks good" is not a release. Nothing merges without an explicit go.
2. Permissions: graduated, not global
Agents here run with graduated rights. Reading within the project: generous. Writing: inside their own workshop. Anything beyond that — system commands, access outside the project, potentially risky operations — triggers a prompt I confirm individually.
It gets interesting at scale. When a swarm of two dozen agents was set to sift a mountain of photos in parallel, per-action confirmations would have meant hundreds of clicks — a click storm that trains you to wave everything through, including the wrong thing. The solution: before launch, the required rights are granted once, deliberately, scoped tightly to that specific job. Permissions are only a real guardrail if operating them doesn't degenerate into rubber-stamping.
3. Verification: claiming isn't showing
An agent reporting "done, everything works" has so far produced a claim. House rules demand evidence: the code must build cleanly, the automated tests must pass, the website must actually start once and respond. Only then does it get presented. Why that's non-negotiable is the subject of Convincingly wrong — the story of a confidently delivered misdiagnosis.
4. Ask instead of improvising
The least conspicuous guardrail, possibly the most important. Agents are tenacious problem-solvers — hit an obstacle, and they start improvising, building long detours if need be. That's exactly where risk lives: a creative route around a security boundary is still a bypassed security boundary.
During one troubleshooting session, an agent ran into a locked-down part of the live system and started constructing substitute chains of evidence. My instruction, recorded as a rule ever since: just ask directly. "May I read X?" costs me ten seconds, keeps the boundary intact — and is faster than any workaround. A good agent treats an obstacle not as a puzzle to outwit but as a signal to fetch the human.
The long leash
None of these guardrails make the agent slower or dumber. Within the boundaries it decides freely how to work — hence the long leash. But reach and risk stay coupled: broad freedom inside the sandbox, questions at the edges, human sign-off at the threshold to reality.
If you're starting to let AI agents work for you — and the tools for it are becoming very accessible — I'd recommend exactly this order: build the environment first, then increase the autonomy. Not the other way round.
/compact — the essentials, if context is running low:
Letting AI agents work autonomously on code for hours sounds like a loss of control — in practice it works, not because the AI is trusted like a colleague, but because the environment is built so that mistakes stay small. Four guardrails carry it: an isolated working copy for every agent where nothing merges without an explicit go, graduated rather than global permissions, evidence instead of claims, and the rule to ask instead of improvising. Within those boundaries the agent decides freely how to work — but anyone starting to let AI agents work should build the environment first and increase the autonomy second, not the other way round.