What are some tasks which are you are still afraid of letting your agents do autonomously?
by•
Agent capabilities are improving incredibly fast, but there’s still a big gap between “the agent can do this” and “I’m comfortable letting it do this completely unsupervised.”
For me, anything involving production infrastructure, credentials, modifying or deleting data, deployments, or actions with external consequences still feels like it needs some kind of oversight.
Curious where others draw the line. What tasks do you still keep a human in the loop for, and what would need to change for you to trust an agent with them autonomously?
113 views
Replies
minimalist phone: reduce your screentime
I would not like to give them manage my money.
Harden
@busmark_w_nika haha, fair enough, I doubt anyone will trust agents with money in the near future but let me think out loud and ask anyway - what guardrails can you think of which can help you trust an agent with your money?
minimalist phone: reduce your screentime
@rishav99 Maybe I would be okay to give them some dedicated card with a limited amount of money.
@busmark_w_nika money is the clean case because the line there is not really about size. i would let an agent move a large amount i can see and reverse, and not a small one i cannot audit afterwards. the thread keeps sorting by blast radius when the thing that decides it is whether you can tell what happened.
Harden
Deleting production data.
I trust agents with a lot, but I’m not ready for “I cleaned up some unused tables for you” to become the last message I ever see :)
Running Linux, so sudo access is the line for me. I'll let an agent touch app code and even restart containers, but anything that needs root, package installs, systemd units, firewall rules, stays manual. One bad sudo rm or a misconfigured service file and you're rebuilding the box, not just reverting a commit.
Harden
@wwenioaguiar Yeah, root access if a hard line for sure 😅
Curious though, what would it take for you to move that line? There must be some privileged actions which you would be ok with your agents doing right? I guess some form of guarantees of this enforcement will probably let you do it?
@rishav99 Maybe a dry-run mode that shows the exact command before running it, and the agent only allowed to touch specific things, like restarting one service, never general commands like sudo apt or firewall rules.
Harden
@wwenioaguiar Hmm. It seems like the issue isn’t really sudo itself, it’s scope + predictability.
You’d be okay with privileged actions if the agent was tightly constrained to an explicit allowlist and you could see exactly what it was about to do. This is actually one of the features which we are working, you can supply a policy in natural language and we guarantee its adherence. Perhaps this is when it will become a lot more trustworthy for you.
I still review database migration an agent proposes before it runs. Schema changes are too easy to get subtly wrong. Would a dry run mode with diff previews change your comfort level here?