I use it in a devcontainer. Protects me from most agent stupidity, though not malice. I give it read-only access to git origin and relevant AWS infra, so any remote changes are made by me from the host (manually or scripted).