Most work with an agent is safe and reversible: a failed turn is rolled back, a wrong edit is rewritten. But this work has two points where a mistake costs disproportionately much, and both are easy to skip on autopilot. The first is the start of an autonomous session, where you let the agent work for a long time without constant supervision. The second is the merge, where an unverified diff stops being a draft and becomes repository history. The sign that the point was skipped is simple: the session was launched without naming when it should stop, or the branch was merged without reading what was in it.
The naive move at both points is to trust that "it all seems fine". Before an autonomous session: the agent is selected, the task is written, the launch button is there - so you can go. Before a merge: the agent reported it is done, the diff looks plausible, the tests "pass" by its account - so you can merge. Both moves save half a minute now and open the door to expensive consequences later, because it is exactly at these points that the cost of a mistake is highest and the warning signals are fewest.
It breaks on the fact that autonomy and integration are steps with irreversible consequences. A long session without set boundaries can run in the wrong direction for hours, spending tokens and touching what you did not intend to hand over. A merge without reading the diff brings into the shared branch what no one looked at with their eyes: unrelated files, generated garbage, an accidentally committed secret. A rollback here is possible, but it is already public and costly - unlike a local turn that no one but you ever saw.
So both points are closed with a short checklist, not with a general sense of readiness. Before an autonomous session you check five things. The agent and the execution environment are named explicitly - you know who will work and where. The task has stop conditions - a condition under which the session halts on its own rather than running forever. The worktree or branch is isolated - the agent does not write to the active branch. Permissions and the network are minimal - exactly what is necessary is allowed. Secrets are passed in a supported way, not written into the prompt or into a file under version control.
Each item of the start list answers a concrete question of trust. The named agent and environment remove the ambiguity of "which agent and where". Stop conditions bound the horizon: without them autonomy turns into uncontrolled spending. Isolation keeps the radius of error within a separate branch. Minimal permissions and network are the difference between "the agent could not do harm" and "the agent got lucky not to". A supported way of passing secrets keeps them from leaking into a log, into the context or into the diff. The five items are not over-caution but a list of what can no longer be fixed once the session runs.
Before a merge you check six things, and the first is the main one. The diff is read by a human, not only by the agent: this is the one check that cannot be delegated to the one whose work is being checked. The acceptance criteria are verified one by one, not in bulk. Targeted tests and the relevant broader ones are run - in your run, not in the agent's retelling. The diff has no unrelated, generated or secret files. Review findings are resolved or explicitly accepted - not ignored. The rollback and compatibility are understood - what to do if the edit turns out wrong after it is already merged.
Why the diff is read by a human specifically is worth stating separately. Quick Review gives an independent second opinion by running a separate agent over the changes, and that is valuable - but it is still an agent evaluating an agent's work. At the merge responsibility closes: a human brings code into the shared branch, and the last one to see the changes whole must also be a human. An automatic check narrows what to read but does not cancel the reading - otherwise one model both writes and approves, and the blind spot of one becomes the blind spot of both.
The cost of these checks is minutes before an irreversible step, and it is a favorable trade. Reading the diff and running the tests before a merge costs a few minutes; rolling back a merged regression out of a shared branch that others have already synced with costs hours and other people's time. Setting stop conditions before a session is one phrase; stopping by hand an autonomous run that went the wrong way and taking apart its trace costs far more. The checklist does not slow you down but moves the cost to where it is smallest.
You should check that the checklist worked by its own trace. After a correctly closed merge you can name the command you checked with, show the diff you read and list the review findings you accepted. After a correctly launched session you can say under what condition it will stop and in which branch its result sits. If there is no answer to any of these questions, the checklist was recited formally rather than passed - and the point stayed open.
The typical failures of both points mirror each other. At the start: launching a session without stop conditions and returning to endless spending; granting wide permissions "so it does not get in the way" and getting extra effects; writing a secret into the prompt. At the merge: taking the agent's report for a read diff; verifying criteria in bulk rather than one by one; merging a branch with unrelated files touched; ignoring a review finding instead of an explicit decision. The sign of all of them is the same: an irreversible step taken without a short check that would have taken a minute. Go through the list before the step, not after, and most of these failures simply will not occur.