Per the commentary and author, the best way to prevent "rogue changes" is to ask the LLM kindly not to make any changes.
I'd suggest a better way: Don't give it permission to make actual changes.
Why would you give an LLM the keys to the kingdom? Would you trust your just on-boarded intern with those kinds of permissions? No? Then why trust a machine known to not follow directions?
Wild that it doesn’t seem to be sinking in with this guy that not only should the agent not have access to the production DB, but that you can’t trust anything it says, including its apologies, excuses, and explanations of past failure. It doesn’t “understand” what it did. I’m not sure the author does either, since he doesn’t seem to know how to even check himself.
I'd suggest a better way: Don't give it permission to make actual changes.
Why would you give an LLM the keys to the kingdom? Would you trust your just on-boarded intern with those kinds of permissions? No? Then why trust a machine known to not follow directions?