Marketing pages for agent tools all say the same thing: you stay in control. The useful work is the questionnaire you actually run before the tool gets filesystem, shell, and network.

Questions 6 through 10 on blast radius, and 24 through 27 that vendors dislike, are the difference between an adoption review and an incident review. "It can write wherever the process can reach" is not a repo-scoped tool. It is your home directory and your SSH keys.

At Ascendra Ventures we treat that list as written scope for any agent we add to a build: who it runs as, what it may read and write, what the worst single action is, and whether those limits are enforced by the OS or by the model's good behavior.

Which question has killed a tool for you most recently: identity, blast radius, or the ones vendors hate?