How about implementing proper permissions on the tool use or if you need more flexibility a dedicated model to analyse potential impact? (Like Claude Code's Autopilot but more configurable)?
I find solutions like this to be a like trying to patch a leaking boat on a lake with duct tape. It will help, but it's not a proper solution.
Also, often the tasks you want the AI to perform are in the outside world. Like "connect to my servers, and figure out X and Y".
The proper way is permission isolation. I run a small k8 cluster in the homelab and I have 3 types of pod/agent combinations for my AI agents. Read only, one that can change my gitops but it needs to create PRs that admin approves, and admin.
Likewise with code. I have a forgejo git instance where agents have ability to create feature branches and so on, but merging is gated.
Those things require "GH enterprise features".
In fact more and more things we do at home will require "enterprise features". Why? Because a person with AI is basically a small team, but some of team members behave like Chimps on crack... So security must be top notch.
What are the proper permissions for an agent? An agent shouldn't be able to read ~/.ssh, but that means a bash tool that spawns `cat` is different than one that spawns an ssh client. I don't allow my agents to use git commit, except sometimes I ask an agent to split up a complicated branch that I can't be bothered to split myself. rm'ing intermediary files is fine, but rm'ing committed files is bad, unless the agent has done *.bak renaming and is cleaning up itself, etc.
I don't think "proper" permissions are possible without dramatically limiting the way people use these tools.
I find solutions like this to be a like trying to patch a leaking boat on a lake with duct tape. It will help, but it's not a proper solution.
Also, often the tasks you want the AI to perform are in the outside world. Like "connect to my servers, and figure out X and Y".
The proper way is permission isolation. I run a small k8 cluster in the homelab and I have 3 types of pod/agent combinations for my AI agents. Read only, one that can change my gitops but it needs to create PRs that admin approves, and admin.
Likewise with code. I have a forgejo git instance where agents have ability to create feature branches and so on, but merging is gated.
Those things require "GH enterprise features".
In fact more and more things we do at home will require "enterprise features". Why? Because a person with AI is basically a small team, but some of team members behave like Chimps on crack... So security must be top notch.