How do you stop AI from building things you never asked for?

I'm not a developer. I came up writing HTML, CSS and Sass, and now I build by directing AI agents.

With AI, adding a feature is cheap. That makes scope creep really easy.

One thing that helps me: my project's README has a "what it doesn't do" section. Things I decided on purpose not to build, each one because it would add legal risk, security risk, or a number I couldn't defend.

Since I don't write the code, my control lives in decisions like those.

I'm curious how others handle it. Do you keep something similar? What actually stops the AI from widening scope on you?