Start with the least powerful mode
A coding agent does not need write access to explain a file, search for a symbol, or summarize a diff. Start in a read-only mode whenever the real task is understanding the codebase.
Truss separates Chat, Plan, and Agent for that reason. Chat is non-mutating conversation, Plan is read-only investigation and task planning, and Agent is the mode where workspace tools can act according to your permission policy.
Treat terminal access differently from file context
Reading a source file and running a shell command are not the same risk. A command can change files, contact a network service, alter a repository, or consume resources. Keep terminal execution visible and approve it at the right level for the work.
A useful policy is specific rather than dramatic: allow safe inspection commands for a session, ask before commands that mutate the workspace, and preserve a human checkpoint before actions that affect remote systems.
Make Git the final review layer
Even a well-configured agent can misunderstand a request. Git gives you an independent way to inspect the result. Review changed files, read the diff, run tests, and commit only after the work satisfies the project’s normal standards.
That is not redundant process. It turns agent work into ordinary software work with a faster first draft, instead of trusting a model to declare its own result correct.
Use context and permissions together
Bad context can make a safe agent unhelpful, while broad permissions can make a capable agent risky. Keep the task focused, ask the agent to inspect relevant code first, and grant only the tools it needs for the next step.
The goal is not to eliminate agent autonomy. It is to make autonomy legible: you should know what the agent can do, what it did, and how to stop or review it.
Next steps
Put it to work in your own workspace.
Pick the surface that fits your day, then connect a model you control.
FAQ
Questions developers ask before switching.
Can Chat mode change my files?
No. Chat is designed for non-mutating codebase questions. Use Agent only when you intend to allow workspace tools.
Should I allow every tool for every task?
No. Use the smallest permission scope that can complete the task, and raise it only when the task genuinely needs more capability.