An agent that can run commands can also run the wrong ones. Controls on commands and secrets are the foundation of safe use.
Define what is allowed
Allow a small set of expected commands, such as building, running tests, and linting. Require explicit approval for anything that deletes files, installs software, or reaches the network.
Watch the filesystem
Confine the agent to the project directory. Keep your home directory, other repositories, and credential stores out of reach. Use version control so every change is visible and reversible.
Protect signing material
Certificates, private keys, provisioning profiles, and App Store credentials should never be in the agent's environment. Perform signing in a separate, controlled process.
Handle secrets carefully
API keys in source files or environment variables can be read by the agent and may end up in logs or prompts. Use placeholders and a separate mechanism for real values at build time.
Guard the supply chain
Review any new dependency an agent proposes. Confirm the package name and source, and pin versions.
Audit
Record executed commands and file changes. When something goes wrong, you need to know what happened.
Takeaway
Assume the agent can be tricked by malicious text in files or web content, and limit what it can do so that a mistake does not become a breach.
Continue with the book
Explore the full treatment, worked examples, and exercises in Agentic iOS App Development.
Adapted from Agentic iOS App Development, published by Choral Software. Article text and original examples © 2026 Choral Software. All rights reserved.