Coding agents that stay inside the fence
A coding agent can move from suggestion to production impact in a single tool call. The fence must stand outside the model.
Separate reading, writing and release
Scope repository access by project and branch. Production deployment, secret changes and destructive operations stay outside unsupervised authority. Human review covers the actual code differences and checks — approving a plan never approves a later, changed patch.
Isolate execution
Generated commands run in a constrained workspace with network, filesystem, time and resource limits matched to the task. Secrets reach only the narrow process that needs them — and stay out of prompts, records and generated files.
Verify the supply chain
Record dependency changes, lockfiles, build outputs and security checks. Test prompt injection through issues, documentation and dependency metadata. A clean scan is evidence for one release — not a promise against unknown flaws.