Where would you put the safety line for an agent running commands in a repo?

I have a practical question for people who care about local/CI safety. When a coding assistant works inside a repo, it is not only editing code. It may run tests, install packages, start services, touch config files, or suggest a CI change. Some of that is normal. Some of it feels like it should require a hard stop. In one small project, I let the agent install a package without thinking much, but I stopped when it wanted to change a CI config file