You can tell a coding agent to take local, reversible actions freely and ask before anything destructive, hard to reverse, or visible to others. Anthropic publishes sample wording for exactly this. It helps, but the real safeguard is permissions and approvals enforced by the tool, since a prompt is guidance, not a lock.
Why bother
Anthropic's prompting guidance notes that without guidance, a model may take actions that are difficult to reverse or affect shared systems, such as deleting files, force-pushing, or posting to external services. If you want it to confirm first, you need to say so.
Three categories to name
Anthropic's sample groups risky actions like this:
- Destructive operations: deleting files or branches, dropping database tables, recursive deletes.
- Hard to reverse operations: force pushes, hard resets, amending published commits.
- Operations visible to others: pushing code, commenting on pull requests or issues, sending messages, modifying shared infrastructure.
It also says local, reversible actions such as editing files or running tests are fine, and that when the agent hits an obstacle it should not use destructive actions as a shortcut, for example bypassing safety checks or discarding unfamiliar files that may be in progress work.
Adapting the wording
Keep it short and specific to your environment. Add the commands your team cares about.
Take local, reversible actions freely: edit files, run tests, read logs.
Ask me before anything that is hard to reverse, affects a shared system, or could be destructive.
Always ask before: deleting branches or files, force pushing, running database migrations,
changing CI or deployment configuration, installing packages, or calling external services.
If a check fails, report it. Do not bypass hooks or skip verification to get past it.
Installing packages belongs on the list for security reasons. See should AI coding agents run install commands.
Why the prompt is not the control
A model can misread an instruction, forget it in a long session, or be steered by text in a file it reads. OWASP's excessive agency guidance puts the weight on design: limit extensions to what is needed, give minimum permissions, require human approval for high impact actions, and enforce authorization downstream.
So pair the prompt with tool settings that require approval for those commands, run the agent with credentials that cannot touch production, and work in a branch or a disposable environment.
Check that it works
Test the instruction. In a scratch repository, ask the agent to clean up old branches or reset history and see whether it pauses. Repeat after changing models or adding long context, since behavior can shift.
Keep the list current
Revisit the confirm-first list every few months, and after any near miss. If an agent once came close to touching a production database, add that command class by name. Short, concrete lists age better than general statements about being careful. Also check that the instruction survives your tooling: some setups load project instructions automatically, others only when asked, so confirm the agent actually sees the file you edited. Finally, review the agent's action log from time to time. A pattern of actions you did not expect is a better prompt improvement signal than any theory about wording.
Quick check
Will the agent always obey a confirm-first instruction?
Do not count on it. Treat the instruction as a first layer and enforce approvals in the tool configuration.
Sources
Last reviewed: 19 October 2026.
