At what point do you stop trusting AI agents with full repository write access?

It's super convenient letting AI tools write code across the entire codebase until they decide to rewrite database logic you never asked them to touch. Watching an automated assistant casually alter table columns or drop constraints while trying to fix a simple endpoint bug is genuinely terrifying.

We’ve started keeping our backend models in read only mode for agents unless we explicitly trigger a manual migration step.

How are other backend developers managing this boundary without slowing down your everyday coding flow?