Checklist
Draw the coding agent's execution surface before granting autonomy
The risk boundary is the set of things the agent can cause, not the chat window.
When it fits
- A coding agent can edit code, run commands or call tools, but nobody has mapped what that actually reaches.
When to avoid it
- The map becomes stale when tools, workflows or agent products change; repeat it after material configuration changes.
Checklist
- Repository write scope known.
- Shell/runtime capability known.
- Network path known.
- Tools/MCP known.
- Secrets and CI exposure known.
- Deployment or production path known.
Why it matters
List repository write access, shell commands, network egress, package installation, MCP/tools, CI triggers, secrets and deployment paths. Mark which actions are read-only, reversible, privileged or externally visible. Use the map to remove capability the task does not need.
An example
A docs task reveals the agent also has package-install and workflow-write capability, so those permissions are removed for the task.
Check your result
You can name the highest-impact action the agent could currently take and why it needs that access.
Keep this limit in mind
- The map becomes stale when tools, workflows or agent products change; repeat it after material configuration changes.
Connected ideas
Useful withGive the agent only the tools this job needs
Evidence and sources
NIST SSDF recommends integrating secure development practices into the software lifecycle rather than treating security as a separate late-stage review.
The framework is high-level and must be tailored to the organization's development model and risk.
Secure Software Development Framework (SSDF) Version 1.1 · SSDF overview
NIST SP 800-218A adds AI-specific practices and considerations to the existing SSDF, reinforcing that AI-enabled development inherits ordinary software-security obligations plus additional AI risks.
SP 800-218A targets producers and acquirers of AI models and systems broadly; coding-assistant controls here are a narrower adaptation.
Secure Software Development Practices for Generative AI and Dual-Use Foundation Models: An SSDF Community Profile · Abstract and introduction