When people say new models are slowed down by safety concerns, they usually imagine a “dangerous intelligence”. In practice the risk is often more mundane: an agent deleted the wrong file, sent the wrong email or changed data in production.
My working technique is a ladder of permissions.
First AI only reads: it studies the repository, logs, documentation. Then it proposes a plan and a list of changes. After confirmation it can create a branch, write code and tests. Applying migrations, sending messages and touching production happen only as a separate human action.
It helps to set the boundary explicitly in the prompt:
You are working in read-only mode. First describe the plan, the risks and the list of files. Don’t change anything without my confirmation. For irreversible actions, prepare the command but don’t run it.
This isn’t distrust of AI. Normal engineering works the same way: an intern, a developer and an administrator have different keys to the system.
The technique is especially needed for agents with access to an API, a database, email and the file system. It isn’t needed for a one-off question or a text draft: there the cost of a mistake is almost zero.
A good agent isn’t the one given all the permissions. It’s the one whose permissions grow along with how verifiable its work is.