Imagine you just hired 500 junior engineers overnight. They're fast, tireless, and eager — but they'll happily rm -rf your production database if you ask the wrong way. How do you keep them productive without a senior engineer reviewing every single keystroke? That's roughly the situation companies are in right now with coding agents, and this paper argues we've been overcomplicating the answer.

The dominant approach today is what the author calls "agentic scaffolding": layer more AI on top of your AI. Add a critic model to review the coder's work, add a planner to decompose tasks, add a verifier to double-check the critic. Each layer burns tokens, adds latency, and — crucially — still relies on probabilistic judgment that can be wrong.

Winninger's argument is refreshingly boring: we already solved this problem for humans decades ago. When you onboard a new engineer, you don't assign a manager to watch every commit. Instead, you use structural constraints:

• Access control — the intern can't touch prod because their credentials don't grant it, not because someone is watching.
• Network policies — the CI runner can't exfiltrate data because the firewall drops the packets.
• Linters and CI checks — bad code doesn't merge because tooling rejects it deterministically, not because a reviewer happened to catch it.

These same guardrails, the paper argues, transfer directly to coding agents — and they're dramatically cheaper than the AI-watching-AI approach. A firewall rule costs zero tokens per request. A pre-commit hook costs zero tokens per commit. Contrast that with an LLM critic that has to re-read the diff every time.

The key insight is a reframing: steerability is not primarily a model-training problem, it's a systems problem. Instead of asking "how do we make the agent want to behave?", ask "what can we make it structurally incapable of doing wrong?" The former is a research frontier; the latter is standard sysadmin work with 40 years of tooling behind it.

The paper sketches an end-to-end system built on this principle — presumably wiring together sandboxes, scoped credentials, network egress rules, and tool-enforced conventions — as an alternative substrate for what the AI safety community calls "scalable oversight." The pitch to practitioners: you don't need a novel research breakthrough to deploy agents safely. You need to treat them like the powerful, occasionally reckless coworkers they are, and apply the boring controls you already know how to configure.