Running agents unattended, overnight, and not regretting it

At some point every person running an agentic coding harness asks the same question: can this run while I sleep? The honest answer depends less on how capable the model is and more on how the surrounding system is built. A capable model making an irreversible mistake at 3am is a much worse outcome than a mediocre model making a reversible one, and the difference between those two worlds is entirely a design choice, not a model choice.

The instinct most people reach for first is approval gates: have the agent stop and ask before doing anything consequential. This works fine when someone is at the keyboard. It fails completely when nobody is. An approval gate with no one to approve it is just a hang — the run stops, the queue backs up, and by morning you’ve lost eight hours to a question that a human could have answered in five seconds. If the goal is genuine unattended operation, gates are the wrong primitive. What you want instead is recoverability: make every action something that can be undone or inspected after the fact, and let the agent proceed without asking.

The clearest lever for this is version control, used deliberately rather than incidentally. Commit early, commit often, and commit on a branch, not on the branch anyone depends on. A commit is nearly free — it costs a few seconds and a bit of history — and it turns every unit of work into a checkpoint you can diff, revert, or cherry-pick from later. An agent that commits every coherent change as it goes, with a real message describing what changed and why, produces a run that’s auditable after the fact even if nothing was watched while it happened. Compare that to a run that makes one giant commit at the end, or worse, leaves changes sitting uncommitted: if something goes wrong halfway through, you have no way to tell which parts of the working tree were fine and which weren’t.

The corollary is a hard rule against destructive git operations in unattended mode. No force-push, ever, to anything another person or process might depend on. No hard reset that discards history rather than layering a new commit on top. No interactive rebase that requires a human to resolve conflicts in real time. These commands exist because they’re occasionally the right tool, but they share a property that makes them wrong for unattended use: they collapse the undo log. The entire value of frequent small commits is that they give you a timeline to walk back through, and a force-push or hard reset can erase exactly the checkpoints you were relying on. If the agent needs to fix a mistake, the safe move is always a new commit that fixes it forward, not a rewrite of history that pretends the mistake never happened.

Branches do more work here than people give them credit for. An agent working unattended should default to a working branch rather than the default branch, precisely because a branch is a blast-radius boundary. If the whole run goes sideways, the fix is to not merge that branch — a zero-cost recovery — rather than to untangle a series of bad commits on main. This also means the agent can be aggressive and fast on its own branch in a way it shouldn’t be on shared history: breaking things temporarily while iterating is fine when nothing else depends on that state yet.

The other half of safe unattended operation is scoping what the agent is allowed to touch, and being honest about the categories that stay off-limits regardless of how confident the run has been so far. Financial transactions, credential entry, permanent deletion, security-setting changes — these aren’t things you loosen because the agent has had a good night. They’re categorical, not situational, and the harness should encode them as hard stops rather than as judgment calls the agent makes fresh each time. Recoverability handles the broad middle of “this could be wrong, but we can fix it” — it does not, and should not, extend to the narrow set of actions that can’t be walked back at all.

There’s a psychological shift required to actually trust this setup, and it’s worth naming: you have to accept that the agent will sometimes do something in the night that you’d have vetoed if asked. That’s the trade. What you get in exchange is throughput — real work happening across the hours nobody is available to gate it — and what you’re protected against, if the rules above are actually followed, is anything that can’t be found and fixed the next morning with a diff and a few minutes of reading. That’s a good trade for most software work. It stops being a good trade the moment the harness starts treating “unattended” as license to skip the discipline that makes recovery possible, rather than as the reason that discipline exists in the first place.

If I had to compress this into one sentence for someone setting up their first overnight run: stop asking permission and start leaving a trail. The permission was never going to arrive in time to matter, and the trail is the only thing that lets you sleep through the run and still trust the result in the morning.