Autonomy without unbounded authority

Scoped read-only context required for reasoning and AST indexing within permitted repository paths.

Mitigation: Path normalization prevents traversal outside task workspace.

Required for synthesizing code diffs inside isolated ephemeral workspace or git worktree.

Mitigation: Restricted strictly to active git worktree; cannot touch root dotfiles or .git/config.

Potential data egress channel. Agents may need to pull documentation, but unauthorized outbound requests risk exfiltration.

Mitigation: Domain allowlisting + operator confirmation dialog specifying destination URL.

Modifies upstream remote history and triggers external CI/CD pipelines and webhooks.

Mitigation: Operator must visually review full unified diff and sign commit approval.

Direct operational impact on live customer infrastructure and production services.

Mitigation: Multi-party approval gate + dry-run verification run required.

Risk of catastrophic data loss or table locks in shared databases.

Mitigation: Disallowed on production databases; permitted on ephemeral test containers with confirmation.

Arbitrary shell execution with raw parameters bypasses structured tool boundary contracts.

Mitigation: Deny-first posture. Only parameterized, audited commands (e.g. npm test, cargo build) permitted.

Direct compromise of infrastructure credentials, API keys, or private SSH keys.

Mitigation: Secrets broker intercepts and masks keys before tokens enter LLM prompt context.

Any undeclared, non-schema-validated tool invocation is inherently untrusted.

Mitigation: Default-deny architecture: capabilities must be explicitly declared and granted.