How do you limit the risk when an agent has a terminal and files?

I give access only to the environment needed, without production secrets or unnecessary rights. If the agent reads an untrusted repo, even a README, a dependency or a test result can try to steer it. I don't assume everything in the project directory is safe.

I separate the ability to prepare a change from the right to deploy and access company accounts. The environment should restrict files, network and commands to what the task needs. A container can help, but it isn't automatically perfect protection against every form of dangerous code. Install scripts and tests do work too, so they can also read or send data.