In agentic systems, safe defaults matter more than good warnings.
Because the agent may never read the warning.
As AI agents execute more setup, package, and tool workflows, security has to live in default-off execution paths, not optional caution.
I have seen developer workflows depend on a quiet assumption: a human will notice the suspicious step. The install script. The remote URL. The strange dependency. The unexpected command.
That assumption weakens fast when an agent runs the workflow instead of a person. npm turning off install scripts, git dependencies, and remote-URL installs by default is a useful signal — not because it solves supply-chain security, but because it moves the boundary the right way. The safe path becomes the default path, and risky execution has to be explicitly turned on. A warning assumes a reader who pauses. An agent working through a task does not pause at a comment; it acts on the path in front of it. So the protection cannot be advisory — it has to be the default the runtime enforces before the action runs.
The more we let agents act, the less we can rely on a human catching the one risky step in the stream.
A good guardrail is not one the agent promises to respect. It is one the runtime enforces before action.