A code suggestion is inert until somebody accepts it. An agent with a shell is different. It can turn an idea into an action: modify a repository, install software, run migrations, call cloud tooling or use credentials already available to the developer session.
That authority is what makes agents useful. It is also why agent safety cannot stop at secure code generation. The system has to consider what the agent can do before the next line of application code even exists.
The security boundary moves from the generated text to the authority of the session executing it.
The blast radius is inherited
An agent does not need an exploit if the developer has already given it legitimate access. It inherits the reach of the shell, environment variables, local credentials, network routes and authenticated tools exposed to the session.
That blast radius often includes more than teams realise:
- local source files and uncommitted work
- Git history, branches and remote repositories
- development or production databases
- package registries and installation scripts
- cloud CLIs, deployment platforms and infrastructure state
- API tokens available through environment variables or credential stores
- MCP servers and desktop connectors with their own authority
A model can make a mistake, follow a poisoned instruction or misunderstand the target. A human can approve a broad permission because the task is urgent. The control model must assume that legitimate authority and fallible reasoning will sometimes meet.
Start with the local host
The local shell is the most direct place to evaluate a command before execution. A provider hook or wrapper can send the proposed action to a policy engine. The engine can classify the target and operation, then return an allow, warn or block verdict for known catastrophic classes.
This is where a destructive command guard is useful. It should be narrow. Normal development commands need to stay fast and quiet. A high-confidence database reset against a protected target deserves a very different response, including a visible warning and an audible signal when the interface supports it.
That design avoids making the guard so restrictive that developers disable it. It also keeps the decision independent from the model that proposed the action.
A hook is not a force field
Local interception has a hard edge. It only covers actions that use the supported path. A direct call from an SDK, a native desktop connector or an operation performed by a hosted agent may never touch the local hook.
Logs or workspace changes show that an action happened. This supports investigation but cannot prevent the event.
The host sends the proposed action to policy and can honour the result before execution. This is a preventive path.
A serious product must show the difference. It should also distinguish an adapter that exists from a hook that is installed and a host that has recently proved it is calling that hook. CodeMarine’s planned live canaries are intended to establish this proof boundary.
Remote authority needs remote controls
Server, database and API operations need controls close to the target. There is no universal local interceptor for every possible operation. The architecture has to combine several mechanisms:
- Route supported MCP and API actions through a governed gateway.
- Issue short-lived credentials with the smallest practical scope.
- Attach policy to the target environment through cloud, database or deployment controls.
- Use a sidecar or trusted runner when the agent executes remotely.
- Record sanitized evidence that identifies the agent, session, policy and decision without leaking secrets.
CodeMarine can become the common decision and evidence layer across those paths. It cannot honestly claim to control an operation that never crosses one of them.
Design for the moment someone bypasses permissions
Teams should expect developers to grant broad agent access sometimes. The job of security is not to scold them for needing the tool to work. It is to keep a small, reliable boundary around the actions most likely to cause irreversible damage.
Combine that boundary with continuous code and supply-chain checks, because the action may be indirect. A new package can run an install script. A changed agent rule can persist beyond the current session. A generated infrastructure file can create risk later in CI.
Once an agent gets the shell, the whole development lifecycle becomes the unit of protection. That is the system CodeMarine is being built to watch.