# AI coding agent safety checklist: 10 rules before you let it run commands

> Ten practical rules for letting an AI coding agent run commands on your Mac: use git, read before you allow, and keep permission prompts on.

Canonical: https://herdbell.com/blog/ai-coding-agent-safety-checklist
Author: Herdbell team
Published: 2026-10-27
Last updated: 2026-10-27

An AI coding agent that can run commands is powerful and, sometimes, wrong. These ten habits do not need special tools. They keep a bad command from becoming a bad day.

## The checklist

1. **Work in a git repository** and commit before a big task, so any change can be undone.
2. **Read a command before you allow it,** especially anything with `rm`, `sudo`, `curl | sh`, or a path outside the project.
3. **Keep permission prompts on** rather than skipping them. See [why skipping is risky](https://herdbell.com/blog/claude-code-dangerously-skip-permissions-alternative).
4. **Make answering fast,** so you are never tempted to switch prompts off. A popup you can answer with one key helps.
5. **Give each job its own folder** so one agent cannot touch another project.
6. **Keep secrets out of the chat.** Do not paste keys, tokens or passwords into a prompt.
7. **Review the diff** of what changed before you merge or deploy it.
8. **Pre-approve only what is truly safe,** and keep the rest on ask.
9. **Do not leave requests unanswered for long.** A request you did not read is a request you should deny.
10. **Know how to turn it off.** Learn each agent's stop or interrupt, and how to disconnect any tool that hooks into it.

## Where Herdbell fits

Herdbell does not make an agent safe by itself. It helps with the human part: you see every request the moment it happens, risky commands ask twice, and an unanswered request falls back to the agent's own prompt instead of being approved. The judgement stays yours.

## Common questions

### Is it safe to let an AI agent run shell commands?
It can be, if you keep permissions on, read what you allow, and work in a project you can restore from git. It is risky to skip those checks.

### What commands should I always read twice?
Anything that deletes files, uses sudo, downloads and runs a script, or reaches outside the project folder.

## Related
- [Herdbell: pricing](https://herdbell.com/#pricing)
- [All posts](https://herdbell.com/blog)
- [Skipping Claude Code permissions is risky: a safer way to move faster](https://herdbell.com/blog/claude-code-dangerously-skip-permissions-alternative)
- [How to approve Claude Code permissions without switching windows](https://herdbell.com/blog/approve-claude-code-permissions)
- [How to stop Claude Code and Codex asking for permission every time (safely)](https://herdbell.com/blog/stop-ai-coding-agent-asking-permission)