How about implementing proper permissions on the tool use or if you need more flexibility a dedicated model to analyse potential impact? (Like Claude Code's Autopilot but more configurable)?

I find solutions like this to be a like trying to patch a leaking boat on a lake with duct tape. It will help, but it's not a proper solution.

Also, often the tasks you want the AI to perform are in the outside world. Like "connect to my servers, and figure out X and Y".

The proper way is permission isolation. I run a small k8 cluster in the homelab and I have 3 types of pod/agent combinations for my AI agents. Read only, one that can change my gitops but it needs to create PRs that admin approves, and admin.

Likewise with code. I have a forgejo git instance where agents have ability to create feature branches and so on, but merging is gated.

Those things require "GH enterprise features".

In fact more and more things we do at home will require "enterprise features". Why? Because a person with AI is basically a small team, but some of team members behave like Chimps on crack... So security must be top notch.