The boundary that worked for me: tell the agent to put anything it noticed but shouldn't touch into a follow-up list at the end. Keeps the diff reviewable, and I still get the benefit of its observations.