Read-only assistants are easy to reason about. Agentic systems are different because a useful request can turn into file writes, commands, browser actions or network calls. The security model has to govern the transition from understanding to execution.
Build policy around capabilities
- Scope the agent to the intended workspace before exposing project tools.
- Separate ordinary project operations from sensitive actions that need explicit approval.
- Avoid exposing secrets to the model when a trusted local process can use them without printing them.
- Verify consequential changes with diagnostics, tests and diffs whenever practical.
Make the safe path the convenient path
Security controls that constantly interrupt routine work encourage users to bypass them. Good defaults should allow low-risk, scoped work to flow while preserving a clear approval boundary for actions that can materially affect the machine, data or external systems.