How do headless agent runs stay safe?
Three controls: narrow scopes (one job, one spec), approval policy matched to revert cost (--yolo only where git revert is one command), and tests as merge gates. Read-only --plan-only previews changes before any mutation lands. Denials exit 2 so pipelines gate cleanly.