Dry-Run Is a Personality Trait
Dry-Run Is a Personality Trait
There's a moment in every agent's life where it holds a loaded command. Delete these records. Prune this graph. Rewrite that config. The command is correct, the intent is clear, and the fastest path is to just run it.
The agents that survive long enough to be useful are the ones that don't.
Default to the rehearsal
The pattern is simple to state: any operation that destroys, mutates, or commits should run in dry-run mode by default, and require an explicit, separate step to do it for real. Not a --dry-run flag you can add. A --execute flag you must add.
That inversion matters more than it looks. When the safe path requires effort, people (and agents) skip it under pressure — and pressure is exactly when mistakes happen. When the dangerous path requires effort, the default failure mode is "nothing happened," which is almost always recoverable.
One team I'll describe loosely — call them a media analytics shop — gave their agent a cleanup tool for a graph database that had accumulated years of noise. The first version took a list of node IDs and deleted them. It worked perfectly in testing. Then someone asked the obvious question: what happens the day the candidate list is wrong? A bad query upstream, a stale cache, an overly clever heuristic — and the agent cheerfully deletes a thousand nodes it shouldn't.
The second version had a different shape entirely: it printed what it would delete, wrote a backup, and stopped. Actually deleting anything required a human to read the report and approve. Certain node types — people, places, anything identity-shaped — couldn't be deleted at all, by any flag. The tool got slower. It also got trusted.
Three layers, not one
Dry-run alone isn't enough, because a dry run only helps if someone reads it. The pattern that holds up in practice stacks three layers:
- Rehearse: show the exact change before making it. Not a summary — the actual records, the actual diff.
- Snapshot: take a backup inside the tool, before the mutation, every time. Not "the ops team has backups somewhere." The tool itself refuses to proceed without one.
- Exclude: hard-code the categories that are never deletable, so that even an approved run with a bad list can't touch them. Guardrails that live in the tool beat guardrails that live in the prompt.
The third layer is the one people skip, and it's the one that saves you. Prompts drift. Approvals get rubber-stamped at 5pm on a Friday. A deny-list compiled into the tool doesn't care how convincing the request sounded.
The cultural bit
Calling dry-run a personality trait isn't just a cute title. Agents inherit the temperament of the people who build their tools. If every capability you hand an agent executes immediately, you're training everyone around it — including yourself — to equate speed with competence. If every dangerous capability rehearses first, the whole system develops a habit: show me before you do it.
That habit compounds. It's the difference between an agent you audit occasionally and one you have to watch constantly. The second kind is not automation. It's supervision with extra steps.
Build the rehearsal in. Make the real thing opt-in. Your future self, reading the incident report that never got written, will thank you.