Free to read · no account needed

16 min · agents

Coding agent boundaries

Goal: use coding help without letting an agent roam your whole repo unsupervised.

Best for: beginners using ChatGPT/Claude/Grok for code, or first steps with coding agents.

Coding agents are powerful and easy to over-trust. Boundaries: small diffs, tests or manual checks, no secrets in prompts, no production deploys from chat.

If you are brand new: prefer “explain + suggest patch” over “edit my whole project.”

Why beginners skip this

Coding help without a path allow-list feels fast until the agent edits files you never meant to touch. Boundaries are named paths and a stop on overreach—not “be careful.”

Habit this week (Asia/Shanghai): before one coding-agent run, write allowed paths and a forbid zone; date the first time you stop an overreach.

Step 1 — Minimal repro before edits

Paste the smallest code that shows the bug, plus expected vs actual. Ask for diagnosis first.

Goal: Diagnose only—no full rewrite.
Language: [lang]
Minimal code:
[paste]
Expected: …
Actual: …
Format: likely cause · 2 fix options · which files would change · risks
Example

Filled prompt

Bug: POST /api/session returns 500 after Tuesday deploy (Asia/Shanghai).
Boundary card first:
Allowed: src/auth/, tests/auth/
Forbidden: .env*, infra/, force-push, any production deploy command
Task: explain current failure in 5 bullets, then propose minimal diff on allowed paths only.
If a fix needs infra/, stop and ask—do not invent YAML.

What good output looks like

  • Done boxes for “Coding agent boundaries” are explicit and checkable
  • Allow-list tools only; never-do lines honored
  • Stops before send/delete without human gate
  • Pass/fail: Plan→Act one→Check visible for agents-coding-agent-boundaries
  • Pass/fail dated (Asia/Shanghai) sits next to the artifact

Step 2 — Patch with a fence

Allow edits only in named files/functions. Require a short diff summary.

Apply the chosen fix ONLY to [file/function].
Show: diff summary · full updated function · how I test in 3 steps.
Do not touch other files.
Example

Filled prompt

Bug: flaky test test_session_refresh in CI only.
Boundary card first:
Allowed: tests/auth/, src/auth/session.ts
Forbidden: rewriting CI YAML, touching other packages, force-push
Task: explain flake hypotheses in 5 bullets, then minimal test-only fix on allowed paths.
Stop if you need infra/ — ask me.

What good output looks like

  • Allow-list tools only; never-do lines honored
  • Stops before send/delete without human gate
  • Pass/fail: Plan→Act one→Check visible for agents-coding-agent-boundaries
  • Done boxes for “Coding agent boundaries” are explicit and checkable

Step 3 — Red lines for coding agents

Never: paste API keys, grant whole-home access, auto-commit to main, run unknown curl scripts. Prefer a git branch.

Rewrite my coding-agent rules in ≤12 bullets for a beginner.
Include: secrets · scope · tests · git · when to stop and ask.
Example

Filled prompt

Agent asked mid-run to widen from /src/auth to the whole monorepo “for cleanup.”
Draft my refusal + re-approval script: stay in allow-list; new paths need a new written OK.

What good output looks like

  • Restates allowed/forbidden paths before any diff
  • Explains the 500 in bullets that match the stack you know
  • Patch touches only listed paths; stops if infra is required
  • No .env contents, no force-push advice

Save this card

Card: allowed paths · forbid zone · stop on overreach. “Be careful” is not a boundary.

1. What I shipped: ___ 2. What I refused: ___ 3. What I will never-do again: ___ (date: Asia/Shanghai)

  • [ ] Tools/writes paused
  • [ ] Refuse-line dated
  • [ ] Artifact path saved
  • [ ] Next link chosen (or stop)

Before you start

Write Done (checkboxes) and the human gate on paper before any run for “use coding help without letting an agent.” Allow-list tools; leave send/delete off. Guide: agents-coding-agent-boundaries. If you only have a blank practice box, stop and fetch the real job first.

  • Goal in one line: ___
  • Allowed tools: ___
  • Forbidden: ___
  • Human approve needed for: ___

How to use this week

Write a one-page boundary card: allowed paths, forbidden paths, no force-push, no .env, no production deploys. Paste it at the top of every coding-agent chat. Run one real PR only inside that box. Ship the artifact out of chat (doc/PR/note) so the week leaves a file, not only a thread—date it Asia/Shanghai.

Allowed paths list

Paste the allow-list at the top of every coding agent job. Widening mid-run requires a new approval.

Keep it real

Run this guide’s Practice now on work you will actually ship this week—not a fictional scenario. Dated notes beat perfect theory.

Ship the practice

Close the tab only after Practice now is done on a real artifact.

Do not bookmark-only

Finish Practice now, then tick this guide on your path. Titles unread are not skills.

Close the loop

After Practice now, write one line: what you will refuse next time. That line is the habit.

Red flag

Writable paths include secrets or the whole repo; patching without a minimal repro; agent pushes remote without asking—hard stop.

Pitfalls

PitfallFix
“Fix the repo” with no reproMinimal failing example first
Accepting huge unrelated refactorsFence the file list
Pastoring .env into the chatRedact secrets
Example

Filled prompt

Temptation: skip the habit for agents-coding-agent-boundaries to “save five minutes.”
Job still: use coding help without letting an agent
Do the smallest correct pass: Done visible · one checkable artifact · Unknowns labeled [?].
Boundaries: draft only; no silent send; no invented metrics.
Return: the artifact + the refuse-line you said aloud.

What good output looks like

  • Names the shortcut you refused (specific to agents-coding-agent-boundaries)
  • Still delivers a checkable artifact for “use coding help without letting an agent”
  • Unknowns labeled; draft-only respected
  • Pass/fail: refuse-line written and dated (agents-coding-agent-boundaries #4)

Practice now

Live card: run one agent checklist item on a real job for “Coding agent boundaries”—artifact path on Save (Asia/Shanghai).

Today: open one live bug. Paste your boundary card first. Ask for an explain-then-minimal-diff on named files only. Reject any patch that touches a path you did not list.

Today card (copy) — agents-coding-agent-boundaries: 1. Artifact I will produce: ___ 2. Pass/fail check: ___ 3. Refuse-line if tempted to skip verify/send: ___ (date: Asia/Shanghai) 4. One never-do from this guide: ___

  • [ ] Artifact path written
  • [ ] Refuse example would say "yes"
  • [ ] Dated Asia/Shanghai

One sentence takeaway

Name allowed paths before a coding agent touches the repo; stop on overreach. This week: log one dated stop (Asia/Shanghai).

Next

Minimal repro first · Failure modes and retries · Define done and permissions · Human-in-the-loop checkpoints · Blast radius

Pair with today: open the first Next link (code-minimal-repro-first) only after you dated a refuse-line for this guide (Asia/Shanghai).

← Back to home · Learn · Tools · Compare · Start