Codeuteronomy
The irreversible act belongs to the human hand
Delegate the reversible freely. Keep the irreversible, and authorize it one act at a time.
Most of what an agent does is undoable: a bad edit reverts, a wrong branch deletes, a failed build rebuilds. That safety is what lets you hand over large swaths of work unwatched. A thin set leaves that world: deleting data, deploying, force-pushing over history, sending a message, spending money. Anything that reaches outside the sandbox and can't be pulled back. There the agent's speed and confidence turn into liabilities. It runs a catastrophic command as smoothly as a harmless one, because to it they read the same.
Draw the line at reversibility. The agent runs the reversible half; you perform the irreversible half, or authorize it for that one instance. Authorization does not carry forward. “Yes, deploy” means this deploy, not a standing right and not a blanket auto-accept mode for the session. Permission for an irreversible act is a single transaction, tied to the change in front of you when you grant it.
How to practice it
Curate the permission lists.
Reversible, high-frequency commands on allow; every irreversible one (delete, deploy, force-push, send) prompts, or is denied outright.
No blanket auto-accept
for work that can reach the irreversible; let the agent stop and ask.
Authorize per act.
“Commit and push” covers this change. Grant it again next time.
Encode the gate where you can.
A hook that refuses to push unless a condition holds turns the discipline into a wall.
If a misfire would be a disaster, type it yourself.
Doing it by hand costs nothing next to being wrong about the agent's judgment.