What secure mode gives you
Secure mode turns the agent read-only: it can inspect, plan and report, but it cannot change the system without your say-so. That single property removes most of the risk of an agent running unattended.
Start read-only, then add exceptions
- Enable secure mode before the agent does anything interesting.
- Let the first tasks fail loudly — each denial tells you what the agent actually needs.
- Add exceptions one by one, scoped as narrowly as possible.
- Re-run the same task and confirm only the allowed change happened.
Practices that keep it tight
- Keep the workspace separate from anything you cannot afford to lose.
- Treat every allowlisted path as a permanent decision — review it when the task is done.
- Prefer explicit shell command allowlists over “allow everything”.
- Watch the live logs during the first few runs of any new task.
Secure mode and scheduling
Unattended jobs need the strictest rules: a cron job running at 3 AM has nobody watching it. Keep scheduled agents read-only, cap their daily spend, and route any write through a manual approval step.
The mindset
Secure mode is not paranoia — it is the difference between “the agent read a file” and “the agent changed a file and nobody saw”. The audit trail records both; the policy decides which one is possible.