a quick checklist I run before any agent touches production

scoped tools, secrets out of context, confirmation on consequential actions, full logging, rate limits, and a kill switch. if any box is unchecked it does not ship. simple but it works.