An agentic coding tool that can edit files, run commands and reach the network is a colleague with root access and no onboarding.
The actual risk
The risk is rarely the model writing bad code; review catches that. It is the agent doing things around the code: reading an .env file, running a destructive command, pushing to a branch, calling an external URL with data it should not send, following instructions hidden in a README it just opened. Defaults are built for convenience, not for your threat model.
What guardrails look like
A permission model per repository and risk level: what is allowed, what needs approval, what is denied. Secrets kept out of reach. Network access limited. Hooks and CI checks that enforce the rules instead of trusting them. An audit trail of what the agent changed and who approved it.
A colleague with root access and no onboarding.
How we set it up
One workshop with your dev leads to see how the tools are really used. A permission model and secrets strategy that fit your risk profile. Configured policies and CI checks, implemented together with your engineers. And a half-day session so the team understands the rules and the reasons, which is what keeps them followed.