Anything with write access to a host and a language model in its decision path needs three things before it is allowed to run: a stop, a record, and a human. Not because the model is malicious — because it is confident.
1. A stop that works when the model is stuck
systemctl stop ai-ops.service
# and the socket, or the next request spawns it again
systemctl disable --now ai-ops.socketTest the stop. A unit that ignores SIGTERM because it is blocked in a model call is not stoppable; set TimeoutStopSec=15 and make sure SIGKILL lands.
2. A record of what it did, not what it said
Log the commands, the exit codes, and the files touched. Not the reasoning — reasoning is not reproducible, effects are.
logger -t ai-ops "apply unit=$unit rc=$rc files=$(echo "$files" | wc -l)"3. A human who can say no
The cheapest version: the tool writes a diff and stops. Somebody reads it and runs it. The expensive version, and the one people build first, is a rollback path for a change nobody reviewed.
Automation should be able to do the boring 90% and be structurally unable to do the dangerous 10% on its own.
That is not a limitation of the model. It is a design decision about the host, and it survives the next model release.