You automated away the human approval step in CI/CD. You didn't replace what it was doing.

Agents now open PRs, approve low-risk deploys, and run overnight loops with no one watching. Sandboxing bounds what they can reach; RBAC bounds their credentials. Neither bounds what they're allowed to do within reach at 3am. Here's the deterministic control-plane bound that does — and how it composes with the isolation you already run.