Let the agents roam. Gate the gate.
On the dev box, my agents run free. In production, nothing moves without a human saying yes. That split is the whole idea.
Freedom where it is cheap. Control where it is not.
A dev box is a pasture. Agents can try things, break things and learn there, because nothing in it matters if it burns. Production is different: a mistake there costs customers and money. So the same agents that roam freely on dev meet a gate before prod.
What makes the range safe.
Own identity per agent
No agent borrows your login. Each has its own, so every action traces to one agent.
Scoped privileges
Each identity gets only what its job needs, and nothing more.
Human approval before prod
Anything that reaches production waits for a person to approve it.
Boundaries enforced structurally
The walls live in the system, not in a prompt. An agent cannot talk its way past them.
Want your agents set up this way?
Start with a free call.
FreeRangeSudo is the practice. The Covenant is the standard behind it.
