One agent drowns in a 1000-line spec. A hundred finish it by morning.
Decompose a reviewed spec into discrete tasks and spawn a fresh headless agent per task. Each unit gets a clean context window and a pass/fail gate.
#permissions
13 posts tagged #permissions.
The fastest way to corrupt money is an agent-built payment system.
Not all code is equally expensive to get wrong. Stop reviewing your agent's output uniformly and spend your scrutiny where a mistake double-charges a customer.
Headless mode isn't a flag you set. It's a privilege you earn.
Taking the human out of the loop is the real unlock - but headless plus loose permissions plus production access is how you wake up to a wiped repo.
Put the confirmation gate in the tool, not the UI.
A destructive-tool annotation plus a mid-call elicitation request gives you a human checkpoint that travels with the capability, whichever client is driving.
A missing parameter is the agent asking what only you know.
When a tool call lacks a parameter, the agent's two instincts - fail or guess - are both wrong. Have the server elicit the missing field against a schema.
A legitimate MCP server with two trust levels is the exploit
The dangerous MCP server isn't the malicious one - it's the convenient all-in-one that reads untrusted data and holds privileged access to a second system.
Stop handing your agent the API key. Give it a phone, three numbers.
An MCP server is a trust boundary, not a passthrough. Hold every secret server-side and expose a curated verb set, so an injected agent is bounded by it.
Your agent says the delete worked. The proof is a sentence it wrote.
Give every consequential tool a declared output schema and validate at the boundary, so the UI gates on a real success boolean instead of the agent's prose.
Your local review and CI gate are one check. Stop maintaining two.
Build your review as a headless command with a tool allowlist, and the check you run by hand becomes the gate on every pull request. One rule, two surfaces.
By the time you review the diff, the destructive call already ran.
Reviewing irreversible actions after the fact is too late. Split tools by reversibility, force a plan, and gate the destructive step behind a human interrupt.
Full Autonomy Is Just a Small Blast Radius
The blocker to running an agent overnight is never capability - it's trust. And you don't earn trust with a smarter model, but with a smaller blast radius.
When your agent reads a webpage, that webpage can give it orders.
Prompt injection is a context-engineering problem. Fence untrusted tool output as data, run a guardrail hook, and cap the blast radius with permissions.
Adding a system to your agent should be a config line, not a codebase.
Hand-writing an adapter per external system is the contextless agent's biggest tax. An MCP server collapses the blowup into one connection, configured once.