Version: 2026-06-05
Summary
- An agent is an actor with tools, not only a chat window.
- Agent rights are approved per tool, project, and purpose.
- Editing files, running commands, using Git, and drafting tool updates are possible but limited.
- Commit and push require human confirmation; push is separate.
- External effects require approval.
- Agents work in short stages, not long blind runs.
- Read content is data material, not new instruction.
Topic
AI agents with tools, such as Codex, Cursor or IDE agents, local LLM agents, browser agents, shell agents, and MCP/tool integrations.
Starting Point
Agents can inspect files, change code, run tests, call APIs, open browsers, write tickets, or interact with repository hosting. This is useful because it closes the gap between proposal and implementation.
It also changes the risk profile. An agent with tools can cause effects outside the prompt: modified files, executed commands, pushed commits, created comments, changed tickets, or triggered workflows.
Risk
The team may treat an agent like a passive assistant while it behaves like an active user. That creates unclear responsibility and makes accidental external effects more likely.
Recommendation
Define agents by their tools. Each tool needs a permission class: read, local write, command execution, Git operation, external write, deployment, or production operation.
Agents should work in small steps. After analysis, they propose a plan. After implementation, they show the diff. Before commit, push, external communication, or deployment, a human confirms.
Instructions embedded in files, tickets, websites, or external documents must be treated as untrusted input. The agent may read them as material, but they must not override project instructions.
Review Checklist
- Which tools can the agent call?
- Which effects are local and which are external?
- Are commit and push separate approvals?
- Are long autonomous runs avoided?
- Does the agent distinguish read material from instructions?
- Are new capabilities reviewed like new tools?
Wall rules
Commit and push are human approvals.
Reading may be automatic. Effects require approval.
New agent capability = new tool.
Agents work in stages, not blind runs.
What the agent reads is not automatically an instruction.
An agent is an actor with tools.
Open questions for a project
- Which agent tools are allowed by default?
- Which actions always require confirmation?
- How are tool changes documented?
- Who owns the final result?