Set the checkpoints for an agent's deploy script rewrite

Your blue-green deploy script is 600 lines of Bash. It drains connections from the live fleet behind your load balancers, flips traffic to the new fleet, runs health checks and rolls back on failure. You want an AI agent to help rewrite it, since most of it is mechanical. But a bug in it takes production down for every customer at once.

Where do you draw the lines? Decide what the agent may draft freely, what you review before it runs anywhere, and what never runs against production without a person.