Three answers today. None of them scale.
approve everythingA person clicks each oneSafe, and the agent saves typing, not work.
hand over the keyThe agent can do anythingFast, and nothing bounds how much.
write the limit inA prompt, a config, a functionNobody on the business side can read it, and every change is a deploy.