You open Cline in VS Code, throw it a refactor task, and there's a toggle that basically says "don't ask me for permission on anything." Auto-approve for everything: file reads, writes, terminal commands, even deletes. I tried it. It works. The agent chains ten, fifteen actions without pausing, without you confirming a single thing, and in a five-minute demo it looks like magic.
The problem isn't that it doesn't work. The problem is that it works until it doesn't. And in a real codebase, that "until it doesn't" isn't some remote possibility — it's a matter of time.
My thesis is simple, and I hold it from the architect's chair, not from fear of AI: total autonomy for a code agent is a pretty demo right up until it deletes something it had no business touching. The restriction isn't distrust toward the tool. It's design. It's the same logic you apply when you give read-only permissions to a service that has no business writing, or when a CI pipeline doesn't have production credentials by default.
If you already read the previous post about how to configure Cline step by step, this is the one that comes after: not the how, but the why behind the restrictions I deliberately leave in place.
