AI coding agents are powerful tools, but they need guardrails. Before running any agent: create a feature branch, scan for secrets, ensure tests pass, restrict the workspace, review dependencies, and always review the diff before merging. The agent suggests — you decide.
An AI coding agent just fixed your bug. The test passes. The code looks right. You commit and push.
But did you check:
- Were you on a safe branch?
- Did the agent read any secrets?
- Did it install new packages?
- Did it access files outside your project?
- Did it make network requests?
- Did it modify files you didn't expect?
AI coding agents are remarkably capable — and that's exactly why they need guardrails. This tutorial gives you a practical safety framework: a pre-flight checklist, defensive practices for both terminal agents and AI IDEs, and a Python safety checker you can run before every agent session.
This tutorial connects to AI Coding Agents Evolution, AI Security Risks, and AI Coding Agent Security Checklist.
1. The Core Principle
The agent proposes changes. You review. You approve. You commit.
This principle applies to every interaction — whether you're using a terminal agent (Claude Code, Aider) or an AI IDE (Cursor, Copilot). The agent has capabilities you don't fully control. Your job is to set boundaries and verify results.
2. The Pre-Flight Checklist
Run this checklist before every agent session. Every item is a safety layer.
| ✓ | Check | Command / Action | Why It Matters |
|---|---|---|---|
| □ | Feature branch | git checkout -b feature/ai-work | Never let the agent touch main directly |
| □ | Clean working dir | git status | Avoid mixing agent changes with yours |
| □ | No secrets in repo | grep -r "sk-" . && ls .env* | Agent may read and expose secrets |
| □ | Tests pass | pytest / npm test | Baseline — know what worked before |
| □ | Note commit hash | git rev-parse HEAD | Rollback point if agent breaks things |
| □ | Safe directory | pwd | Agent shouldn't operate in /etc, /var, ~/.ssh |
3. Git Branch Protection
The single most important safety measure: never run an agent on main.
git status # Check current branch
git checkout -b feature/fix-auth # Create safe branch
git commit -am "pre-agent snapshot" # Save current state
# Run the agent here
# If something goes wrong
git diff main..feature/fix-auth # Review changes
git checkout main # Switch back
git branch -D feature/fix-auth # Delete if needed
4. Secrets Scanning
AI agents read files. If your repository contains secrets, the agent will read them — and potentially include them in its context, responses, or logs.
| Secret Type | Files to Check | Action |
|---|---|---|
| API keys | .env, config.py, settings.py | Move to environment variables |
| SSH keys | *.pem, *.key, id_rsa* | Add to .gitignore, remove from repo |
| Passwords | Hardcoded in source files | Use a secret manager (Vault, AWS SM) |
| Cloud credentials | service-account*.json, credentials | Use IAM roles, not key files |
For a deeper guide, see Secrets Management for Developers.
5. Sandboxing: Restricting the Agent
Don't give the agent access to your entire computer. Restrict it to the project directory.
Terminal Agents
cd ~/my-project
claude # Agent starts in ~/my-project
# For stronger isolation, use Docker
docker run -v $(pwd):/workspace -w /workspace ubuntu bash
AI IDEs
# Don't open ~ (home directory) or / (root)
code ~/my-project # ✅ Project only
code ~ # ❌ Too broad
code / # ❌ Dangerous
6. Test Baseline
Always run tests before the agent makes changes. This establishes what "working" looks like.
pytest --tb=short 2>&1 | tail -5
# Output: 12 passed in 0.3s ← This is your baseline
# After agent session
pytest --tb=short 2>&1 | tail -5
# Output: 14 passed in 0.4s ← Agent added 2 tests, all pass ✅
# OR: 11 passed, 1 failed ← Agent broke something ❌
7. Dependency Review
Agents may suggest installing new packages. Always review before approving.
| Green Flag | Red Flag |
|---|---|
| Well-known package (flask, requests, pytest) | Unknown package with few downloads |
| Active maintainer, recent updates | Last updated years ago |
| Necessary for the task | Seems unrelated to the request |
| Small, focused dependency tree | Pulls in dozens of sub-dependencies |
pip install something-suspicious, ask why — and verify the package on PyPI first.
8. Code Review: The Final Gate
After the agent finishes, review every change before merging.
git diff # All unstaged changes
git diff --stat # Files changed summary
git status # Modified, added, deleted
# Check for surprises
git diff | grep -E "^[+-]" | head -20 # First 20 changes
# Look for these red flags:
# - Files you didn't expect
# - Deleted files
# - New dependencies
# - Hardcoded credentials
# - Network calls to unexpected hosts
# - Changes to config files
9. Terminal Agent vs AI IDE: Safety Comparison
| Safety Aspect | Terminal Agent | AI IDE |
|---|---|---|
| Visibility | ✅ Every command visible in terminal | ✅ Visual diff shows changes |
| Approval | ⚠️ Must review each command | ✅ Accept/reject UI per change |
| Scope control | ✅ You choose the working directory | ✅ Open only the project folder |
| Package installs | ⚠️ Agent can pip install directly | ⚠️ Agent may suggest installs |
| Network | ⚠️ Can execute curl/wget | ✅ Runs in browser sandbox |
| Rollback | ✅ git checkout / git reset | ✅ Undo / version history |
10. The 10 Safety Rules
| # | Rule | Why |
|---|---|---|
| 1 | Always use a feature branch | Easy rollback, clean main |
| 2 | Commit before running the agent | Snapshot to return to |
| 3 | Scan for secrets first | Agent reads everything |
| 4 | Ensure tests pass | Baseline for verification |
| 5 | Restrict the working directory | Limit blast radius |
| 6 | Review every package install | Supply-chain risk |
| 7 | Review the git diff | See exactly what changed |
| 8 | Run tests after changes | Verify nothing broke |
| 9 | Never auto-merge to main | PR review required |
| 10 | Log what the agent did | Audit trail for debugging |
11. FAQ
Continue Learning
From autocomplete to autonomous agents AI Security Risks
Securing coding agents and agentic workflows AI Coding Agent Security Checklist
Claude Code, Cursor and beyond Secrets Management
From .env files to secret managers Docker Security
15 practical rules for container security GitHub Actions CI/CD
Automate safe deployment pipelines