I give my agent passwordless sudo and run it directly on prod, deploying directly to prod. I’m not trolling this is exactly what I do. YOLO.