Lock down your AI coding agent before treating it like an outsourced employee

I compared two workflows: giving AI agents full permissions directly vs. putting them in an isolated environment. I actually ran each for a week and am writing down my experience here. Just to clarify, I'm using command-line tools like Claude Code, but the principles apply to other coding agents as well.