Building An AI Agent Playground Before Giving It Production Access

A coding agent runs cleanup_old_records() against what it thinks is a staging database. It isn't. The connection string came from an environment variable that got overwritten three deploys ago, and the agent just deleted four months of customer orders. It did exactly what it was told. It just had it