Ask HN: How do you gate an autonomous coding agent's shell access?

I've been giving coding agents more autonomy lately, letting them run shell commands unattended for longer stretches, and I don't have a good answer for how people actually gate that beyond "run it in a container and hope." A container limits blast radius but doesn't stop the agent from reading a secret and then making an outbound call in the same session, or force-pushing to a branch it shouldn't touch, or just doing something irreversible while nobody's watching. Curious what people are actually doing: allowlists of commands, human-in-the-loop approval for anything destructive, something built into the agent framework itself, or just accepting the risk because the alternative is too slow? Specifically interested in what happens when the approval step itself fails or times out, does your setup default to allow or deny?