Your agent notices a failing deployment. It reads the logs, identifies the bad commit, drafts a rollback, and now wants to apply it.
Should it just do it?
If it asks for permission at every step, it becomes an expensive autocomplete. If it can do anything it can describe, it becomes a liability. The useful question is not “How smart is the agent?” It is:
Which actions are safe to pre-authorize, which actions need explicit approval, and which actions should be impossible?
That is not a prompt engineering problem. It is a permission design problem.
