The agent prepares, I pull the switch

The short version: My agents run with real permissions on a real box, and some things stay out of their reach on purpose: sudo, deleting a folder that holds a .env file, editing their own permission allowlist, flipping a go-live flag, saving an API key. When an agent hits one of those walls it doesn’t look for a way around. It writes the command or a paste script for me, I run it in a tmux pane, and the script’s last line tells me to have the agent verify and commit. Every guardrail stays where it was.

Get the week's seven in one email, every Monday.

What went wrong

The arrangement came out of the last week of July, when three fixes in three days needed a hand the agents didn’t have: a batch of settings changes on the 28th, an allowlist extension on the 29th, and containing a class of out-of-memory kills on the 30th. The tempting path was to give the agents sudo, or put my user in the docker group, which makes every agent session root-equivalent through the socket. I didn’t, and each fix arrived as a script I could read in thirty seconds.

The one real failure was a long command. On October 2 an agent handed me a 330-character one-liner. I copied it from the rendered terminal, which wraps at about 115 columns. The quoted strings picked up newlines, the trailing path ran as a command of its own, and the result was a broken environment file that needed a second fix.

What we learned

• The wall is the feature. An agent that can’t do something is an agent that has to show its work. A script I run is a script I read.
• The handback matters as much as the command. Every script ends by telling me what the agent should check and commit once I’ve run it, so the loop closes on the agent’s side with evidence.
• Short beats clever. A command that wraps is a command that breaks. Under about 100 characters, or in a file.

What went right

The pattern has held from July to now. Credentials never pass through a chat: the API key the daily release job uses was saved from my own terminal, with a one-liner the agent wrote and I read first. Permission allowlist changes arrive as the exact JSON to paste. The agents stay out of root, out of the docker group, and out of the secrets directory, and the work still gets done.

How to do it (as of October 2026)

1. List the actions that need a human hand: sudo, keys, deletes near a .env, the agent’s own permissions, anything that goes live. Write that list where the agent reads it at startup.
2. Have the agent produce the exact command or script, with a verification line at the end and nothing secret inside it.
3. Keep each command under about 100 characters: cd first, short relative paths, two commands rather than one clever one. If it has to be long, put it in a file and hand over a short invocation.
4. End every script with the handback: what the agent should verify and commit once you’ve run it.
5. Read the command before you run it. The whole point is that a person understood it last.

Status

Still true. It costs me one tmux pane per wall, and I haven’t found a wall worth removing.