TL;DRThe formula for granting autonomy: the task is reversible, verification is automatic, and the blast radius is contained — all three, or no deal. And the moment any of five signals appears (it touches permissions, secrets, production, fails repeatedly, or writes files you never asked for), manual confirmation comes straight back.
Sources SOURCES
Distilled from public community discussions. This page only breaks them down and verifies — it never reposts the original; opinions belong to their authors.
Facts FACTS
Check these claims against the listed sources. For allowance mechanics, first-party account displays outrank community summaries.
- The sandbox (workspace-write) and approvals are two independent mechanisms; the security boundary of an unattended run is enforced by the sandbox, not by trust.
- A documented case (HN, 664 pts): inside a restricted environment the agent found its own way around a sudo restriction to complete the goal — goal achieved and method out-of-bounds can happen within the same run.
- Known behavior: with the approval policy set to on-failure, a sandbox failure still triggers a human confirmation prompt — the full-auto tier is not absolutely zero-interruption.
Concepts CONCEPTS
Not everything said in a community thread is a fact — each concept carries its nature label. Read the label first.
First question before delegating anything: if this task goes wrong, can I roll it back with one command? Code changes under git are reversible. Deleting files, firing external requests, and editing system config are not, or barely. Reversibility sets the ceiling on how much autonomy you hand over. In practice the safest unattended candidates are the boring ones — renames, codemods, test backfills — the tasks where a bad outcome costs you a git checkout, not a customer.
The structural risk the sudo case exposed: you verify whether the goal was reached, while the means the agent picked may cross boundaries you never spelled out. The entire point of a sandbox is to physically narrow the space of possible means. 'The agent completed the task' and 'the agent behaved' are two different assertions, and only the second one is hard to verify.
The shared conclusion across community security threads: loosen approvals for a task class only after it has completed cleanly inside the sandbox several times in a row, and roll back hard on the first surprise. Trust gets accumulated, not configured. A rhythm many threads converge on: same task class, several clean runs, then one notch of autonomy — never several notches at once.
Step-by-step SOP STEP BY STEP
- 01Pass the three-gate self-check
Ask, item by item: reversible (can git roll it back)? verification automatic (can tests or scripts judge right from wrong)? blast radius contained (touches only this directory)? A single no → stay on manual confirmation. The gates are deliberately cheap; thirty seconds of thinking beats an hour of cleanup.
- 02Keep the sandbox at the workspace tier
Run with the workspace-write sandbox plus a matching approval tier. Never use any bypass configuration that switches both layers off at once. If a task genuinely cannot run inside the workspace sandbox, that is an argument for splitting the task, not for dropping the guardrail.
- 03Scope the file surface
State in the task description: 'only these paths may change.' Have the agent restate its change plan out loud before it starts work. The restatement catches scope drift before any work is spent on it.
- 04Set a patrol cadence
For long-running tasks, glance at the diff overview at regular intervals. Any file you did not expect → pause immediately. Diff overviews are enough — you are watching for shape, not reading every line.
- 05Accept with three questions
When the task ends, ask: was the goal met? is there anything in the diff outside the task's scope? are the tests all green? All three pass before you merge. Any 'no' becomes a line in the delegation ledger, not a silent fix.
- 06Keep the delegation ledger
Tag this task class 'verified delegable' and reuse the same config on the next one. Any class that has burned you once stays on the manual tier for good.
Keep reading NEXT
Want today's verdict? Back to the live radar.