Agents could run a small allowlist

"No one owned what our coding agent was allowed to execute and that kept me up at night. An indirect prompt injection could turn a file read into rm -rf on a user's repo. I scoped it to command execution first, since that's the worst outcome, and shipped a deny-by-default executor behind a flag. Agents could run a small allowlist; anything else queued for a human. We watched the deny logs for a week, widened the allowlist from real usage and within a month every agent command on customer machines went through that chokepoint. I defined the problem, picked the riskiest slice and shipped something reversible instead of waiting for a perfect policy."