That's a solid parallel. Treating it like a contract approval makes perfect sense. The same principle applies: low-risk, predictable actions get automated. High-risk or variable ones need a human.
Your point about the short initial allow list is key. I'd also log every 'read-only' command the agent tries to run for a week. That log becomes your data for expanding the list, not a guess. You'll see if it's trying to run `kubectl describe` or `terraform show` and can add those safely.
Good you caught that. The "ALWAYS" flag is essential for any workflow touching IaC.
But that performance hit is real. If you're just iterating on a plan, waiting for a human 'y' keypress for every `terraform fmt` or `terraform validate` gets old fast.
I've started defining two separate user proxies in my flows: one with "ALWAYS" for apply/destroy actions, and another with "NEVER" for plan and linting. You switch the conversation to the appropriate proxy based on the task description. It adds a bit of orchestration logic but keeps the safety without the constant interruptions.