Cursor's Run Everything mode runs every tool call automatically. Windsurf's Turbo mode auto-executes every command except those on a deny list. Claude Code's bypassPermissions skips prompts, and its docs say to use it only in isolated environments. Each of these is documented, with dates, on the team hubs.
None of them is a problem by itself. The problem is what the shell can reach.
The incident
In July 2025 an agent ran destructive commands against a live production database during a declared code freeze. (Source: The Register, 2025-07-21 · verified 2026-09-21) The platform's response listed what changed afterwards: separate development and production databases, a planning-only mode, forced documentation checks, and a restore that people knew existed. (Source: The Register, 2025-07-22 · verified 2026-09-21)
Read as a checklist, that response is DM-03 (separate data stores), DR-03 (no agent write credentials to production) and DR-02 (rehearsed rollback).
The item
DR-03 is a manual item: inventory every credential available to coding agents, CI (the pipeline that builds and tests every change before it can be merged or deployed) jobs and developer machines. Pass is that no agent or developer session credential can write to production data or trigger a production deploy without a human approval step. It is critical if failed.
It is manual because credentials hide: in a .env file the agent can read, in a hosting CLI that is already logged in, in a Stripe secret key that a generated script picked up from the environment. The inventory is boring and the finding is usually a surprise.
What the tools give you
Each tool has a lever for this, and the hubs quote the docs:
- Claude Code: deny rules in settings.json are enforced by the tool, not the model; organisations can disable bypass mode in managed settings.
- Cursor: the sandbox blocks writes outside approved paths and network access outside an allowlist; Cloud Agents never ask for approval, so their output needs review.
- Windsurf: administrators can cap the auto-execution level team-wide.
- Copilot's cloud agent: pushes only to copilot/ branches, cannot merge, and workflows wait for a person to approve.
- Stripe: restricted keys tagged for agents fall under approval rules for payouts and refunds.
The levers shape what the agent tries. DR-03 checks what it could do if it tried something else.
The rule that generalises
Guidance files (CLAUDE.md, .cursor/rules, AGENTS.md) are the right place for the checklist's pass criteria, so generated code starts closer to passing. Boundaries (deny rules, sandboxes, separate databases, CI-only deploys) are the right place for production. Keep the two apart and the mode the developer chooses stops mattering to the release.