What it means to let an agent run unattended

This is the part of running several agents at once that deserves more than a footnote, so here it is on its own.

The trade, stated plainly

An agent that pauses to ask you before every command is not running unattended. It is running attended, slowly. The entire value of parallel agents is that they proceed while you are doing something else, and proceeding means acting without a prompt.

So the honest description is this. Several processes are running real commands on your machine, in your project, while you are not watching. That can be a good trade. It should be a deliberate one, and anybody selling it to you without saying so is leaving out the interesting part.

What is worth insisting on

Given that the agent will act, the useful questions are about blast radius rather than about permission.

Its own workspace

An agent should be working somewhere that belongs to it. Its own branch, its own working copy, so a mistake is contained to a place you can delete rather than spread across the checkout you have open in your editor.

This is also what makes a bad run cheap. If the worst case is a branch you throw away, you will actually use the thing.

Your own copy untouched

Whatever runs, the files you have open should not change under you. Nothing is more alarming than an editor reloading a file you did not edit.

Nothing pushed

There is a large difference between an agent that produces a branch and an agent that pushes one. The first cannot embarrass you in front of your colleagues. The second can, and the failure will be discovered by someone else.

The default worth having is that nothing leaves your machine. Pushing is a thing you do.

A branch, not a merge

What arrives at the end should be a branch you read, not a change already in your project. Review is not a formality here. It is the step that makes the rest of it safe, and an agent that merges its own work has removed the one control that mattered.

What it does not protect you from

Being honest about the limits.

An agent in its own worktree is still running on your machine with your permissions. It can reach your network, your credentials in other tools, and anything outside the project directory that your user can touch. Worktree isolation is about not corrupting your work. It is not a sandbox and should not be described as one.

The commands are real. The installs are real. If a task leads an agent to run something destructive outside its workspace, the worktree does not stop it.

That is the actual shape of the risk, and it is why the sentence at the top matters more than any feature list.

Where the judgement is

Splitting a goal across several agents is a decision made by a model about your codebase. It is usually right. It is not guaranteed, and a bad split shows up as two agents doing overlapping work rather than as anything dramatic.

Reset times for usage windows are sometimes estimates. An interface that shows a guess as though it were a fact is worse than one that shows no number, so a guess should say it is one.

Designed for it

Nuvoa takes the position that this trade should be visible. Each pane is an account with its own workspace, your own copy of the project is never touched, nothing is ever pushed, and what comes back is always a branch to read.

The claims on the site ship with checks that prove them, and those checks run locally with no network and no model. If a claim stops being true, they fail.

If that is the trade you want to make on purpose, join the waitlist.