Pin the Roots or Don't Merge: A Fail-Closed Agent Egress Checklist
A developer has published a fail-closed egress checklist for teams shipping coding agents into shared CI or shared machines, requiring every filesystem root, network host, and executable an agent can reach to be named in…