A 6-point checklist for letting coding agents work unsupervised. What's missing?

While building kosa8 we kept coming back to the same short list of controls that make it reasonable to let Claude Code, Codex or Cursor run without someone watching every command:

1. One VM per agent, not a shared container. Containers share the host kernel; code an LLM wrote a minute ago is untrusted by definition.

2. Network closed by default. Allow-list the model API and your package registries, enforced outside the VM so root inside can't lift it.

3. No long-lived credentials in reach. If ~/.aws or a .env is mounted, the agent has it.

4. Undo for the whole machine. Checkpoint before the risky step and rewind afterwards, processes and all.

5. Sandbox the tools too. Every MCP server is code running with your permissions.

6. A log you can verify. What did the agent actually run, and can you prove nobody edited the record?

Which of these do you actually do today, and what would you add? Honest answers welcome, including "none of them".

(We launch here on 20 October; kosa8 is our take on 1, 2, 4, 5 and 6.)