Junie's leash: approvals, Brave mode, and when to let go

Every coding agent ships with a leash, and the design question is when it tightens. Junie's default is conservative: it edits files freely (those changes land in a reviewable diff), but the moment it wants to run a terminal command, it stops and asks. Brave mode removes the stop. Flip it on and Junie executes commands on its own: builds, test runs, scripts, whatever the plan calls for.

The predictable debate (approvals versus autonomy, safety versus speed) is the wrong one. Every agent ships this dial under some name; Codex has its approval modes, and the reasoning transfers wholesale. Autonomy is a bet you price, and the pricing questions are boring: what's the worst command this task could plausibly run, what would it cost me, and how fast can I get back to a clean state?

What the approval prompt is actually for

A prompt is a checkpoint where a human can catch a command whose consequences the agent didn't price: a destructive migration, a package publish, a curl piped into a shell, an rm aimed at a mis-expanded path. That's real value. But notice what it depends on: you reading the command. Approve forty commands in an afternoon and you stop reading. You're no longer a checkpoint; you're a latency tax that has trained itself to click yes. Approval fatigue is the failure mode nobody designs for, and it's how human-in-the-loop quietly degrades into human-in-the-way, the central trap in human-in-the-loop design.

Approval prompts aren't safety — they're a substitute for the sandbox you haven't built yet.

When I flip Brave mode on

Brave mode is the right call exactly when blast radius is bounded and reverting is cheap. Here's my checklist, and every item on it has to hold:

• The environment is disposable. A dev container, a VM, a checkout with no secrets in the shell environment. If the worst possible command costs you a rebuild, autonomy is nearly free, and sandboxing coding agents covers how to get there.
• The work is branch-scoped and test-covered. A green suite as the oracle, a branch as the undo button. Git reverts files perfectly and side effects not at all: a dropped database does not come back with git reset.
• The task is routine. Dependency bumps, test backfills, mechanical refactors: work where I'd approve every command without thinking anyway. If the prompt would be theater, remove the theater.

Notice what's not on the list: trust in the model. Brave mode doesn't change what Junie decides to run: it removes the checkpoint, nothing else. If the plan is wrong, autonomy gets you to the wrong destination faster and with fewer witnesses.

When the leash stays on

• First runs on a new repo. Watching which commands Junie reaches for is how you learn its instincts, and where your guidelines file needs another line.
• Anything near a one-way door. Migrations, deploy scripts, publishing, infrastructure config. Irreversible operations get a human, always.
• Machines with real credentials. If your shell can reach production, staging secrets, or your SSH keys, then so can the agent: it inherits your environment. That's true of every agent, not a special Junie flaw, and it means "fine on my laptop" is not a policy.

My honest position: run the default approval flow until the prompts bore you. The boredom is data: it means your tasks have become routine and the agent's command habits have survived weeks of your scrutiny. Then move the safety out of the prompt and into the walls: containerize the environment, starve it of secrets, let the test suite judge, and hand Junie the leash it has earned. Brave mode on a sandboxed, well-tested repo is a straightforward productivity win. Brave mode on a credential-laden laptop is an incident report with the timestamp still blank.