You have split one agent into many, each doing less. There is a second split that decides whether the system is safe to leave alone: which agents may actually change things, and which may only look. Not every agent should be allowed near your code, your data, or your money. This chapter sorts your agents by what they may touch, so you know which ones to trust running on their own.
3.9.1What an agent may touch is its blast radius
Split your agents one more way, not by the phase they work in, but by what they are allowed to do when they run. That permission is the agent's blast radius: the worst it could do if it went wrong. One that only reads can embarrass you at most; one that can delete has a blast radius the size of your database.
Five types cover almost everything you will build:
| Type | What it may touch | Trust it alone? |
|---|---|---|
| Reporter | reads only, changes nothing | Yes, from day one |
| Operator | reads and fixes, inside limits you set | Earned slowly |
| Synthesizer | reads many reports, writes one plan | Yes, it only proposes |
| Watcher | a cheap check, often no AI, wakes another agent | Yes, it only pokes |
| Job | a plain script, no AI, same output every time | Yes, it is predictable |
3.9.2Most of your fleet should be reporters
The instinct is to build agents that fix things. Resist it. A reporter that only reads hands you most of the value, knowing what is wrong, with none of the risk, so it can run unattended from the very first day.
Let the fleet be mostly eyes and let only a few earn the right to act. Ten agents watching and telling you the truth is worth more, and far safer, than one agent quietly changing things you never see.
3.9.3An operator earns its reach
An operator reads and then fixes, so it gets the opposite treatment: a short leash that loosens only as it proves itself. Match the leash to the reach. A reporter, a watcher, and a job are safe running constantly, because one changes nothing, one only pokes another awake, and the last does the same predictable thing every time.
The operator is the single type that has to earn its independence, one small class of action at a time. Knowing that up front is what lets you build the safe ones freely and hold the dangerous ones close.
3.9.4Sort your agents by blast radius
This prompt types every agent you have and locks each one down to match:
Act as a senior engineer classifying my agents by blast
radius. For each agent I list, name its type: reporter
(reads only), operator (reads and fixes), synthesizer
(reads reports, writes a plan), watcher (a cheap check that
wakes another), or job (a plain script). Then set each
one's permissions to match: a read-only agent gets no tool
that can change anything. Tell me which may run alone now
and which must stay report-only until it earns more.
My agents and what each one is meant to do:
Do this now: paste the prompt, and make every agent that only needs to look a reporter with no power to change a thing.
