Tool Permissions and the Blast Radius of Autonomous Actions
Not every action an agent can take is equally risky. A good agentic workflow treats permissions as a real safety mechanism, not a nuisance to click through.
Reversible vs. irreversible
| Reversible, low blast radius | Irreversible or wide blast radius |
|---|---|
| Editing a file in your working directory | Force-pushing over shared git history |
| Running a test suite | Dropping a database table |
| Reading logs or searching the codebase | Sending a real email or executing a payment |
| Creating a new branch | Deleting files outside version control |
Reversible actions are safe to let an agent take with light or no supervision, you can always look at the diff, or revert. Irreversible ones deserve your explicit, specific approval every time, not a blanket "yes" given once at the start of the session.
Why agents ask before risky commands
If an agent pauses to confirm before running rm -rf, a force-push, or a production deploy, that's not the tool being overly cautious, it's the last checkpoint before an action that can't be undone. Approving that prompt should mean you actually read what it's about to do, not that you've learned to reflexively click "yes."
Agent: "This will run: git push --force origin main. Proceed?"
❌ Reflexively approving without reading it
✅ Reading it, realizing main is a shared branch, and declining
Principle of least privilege
The same idea that applies to giving a new hire access applies here: an agent working on a frontend bug doesn't need access to your production database credentials or deploy scripts. Scope what an agent can reach, not just what you hope it won't touch. Fewer available tools means fewer categories of mistake are even possible.
WARNING
Never let an agent run a destructive or irreversible command (deleting data, force-pushing, dropping a table, sending a real message or payment) without reading and approving that specific action first. A prior approval for a different action doesn't carry over.
Sandboxing
Where available, run agents in an isolated environment, a container, a disposable branch, a scratch directory, so that even a fully autonomous run's worst-case outcome is "I have to throw this away and start over," not "I broke something in production."