How do you let an AI agent finish the job without production authority?

Neither full production access nor stopping on every step is enough

When an AI agent operates a backend, design drifts toward two extremes. Letting it execute freely in production is dangerous. Waiting for human approval on every change kills the agent loop — think, try, observe, fix never completes.

The real design problem is not grant vs deny. It is an execution boundary that keeps agent autonomy and production safety at the same time.

Sandbox was the wrong word

If you frame this as building a sandbox, you quickly end up managing production copies, branches, and promote flows. What humans want is not environment ops. They want production not to change on its own, and evidence they can review before approving.

LUNO does not treat this as a single Sandbox feature. It is Agent Execution Safety / Agent Governance. In the product UI we avoid the word Sandbox and talk about verification projects and change plans.

Same Agent. Same MCP. Different authority boundary.

The same agent and the same MCP tools can operate under different authority depending on the execution plane. We do not add a separate sandbox API for agents to memorize — we change the boundary.

Three execution planes

The flow looks like this:

Intent → Change Plan → Verification / Canary → Evidence → Human Approval → Production

There are three planes.

Production Governance. The agent can discover, dry-run, and propose. It does not directly execute high-risk production mutations. Changes go through a Change Plan and human approval before production.

Production Canary. A real mutation path runs once against temporary resources in production. Customer IDs, publish, and webhooks stay fail-closed. Only server-created temporary resources are allowlisted, then archived. This is not executing the production plan itself.

Verification Project. Not a copy of production data. A separate project where the agent can execute → observe → retry the intended Change Plan. Only the minimum Form / Master / synthetic draft material needed for that plan is created.

Canary and Verification are not the same

Canary checks side effects that only show up on the production path — same database, same constraints, same mutation route — on temporary resources.

Verification is the place where the agent loop can finish without dying on approval wait. The agent runs a full cycle there and leaves evidence.

Do not mix them. Canary is not another name for Verification, and Verification is not a production clone. Even after both, public-domain confirmation still needs preview or a human check.

sideEffects and recoverability are the contract

If dry-run only says success, humans cannot judge blast radius. Gated changes therefore return sideEffects[] and recoverability from the server.

sideEffects are the shared list of what may happen next for agents and humans. recoverability is not a promise that everything can be rolled back. It states what is automatic, what needs a human, and what cannot be undone — before execution.

Do not trust an agent's self-reported side effects. The server dry-run is the source of truth.

Verification success is not production permission

A successful verification is evidence, not production approval. There is no automatic promote.

Humans approve after seeing what was tried, not by trusting a proposal alone. Production authority stays with humans. Raising agent autonomy is not the same as handing over unlimited production power.

Same Agent. Same MCP. Different authority boundary.

In production the agent proposes. In verification it can execute through the loop. The MCP tools stay the same; only the authority boundary changes.

That matters because agents should not learn a separate sandbox API per runtime. Safety comes from execution-plane design, not more prompt burden.

Connecting the agent loop to human governance

The human role shifts from implementer to approver and supervisor. Agent failure becomes verification cost, not a production incident.

The loop can be asynchronous. Humans do not need to sit in the agent session. If every completed event becomes a notification, the inbox breaks — so only attention-worthy items notify, decisions live in Change Plans, and history stays in Activity. Notifications are a separate article.

The core is short: an AI agent can finish the job without being given wholesale production authority. Verification, Canary, and human approval keep autonomy inside governance. This is not a product that simply adds more agent power.