A team of researchers interviewed 18 software practitioners and surveyed 115 more about how they decide what an AI coding assistant is allowed to do. The findings show a clear split: practitioners want different rules for reading files versus deleting them, for running tests versus pushing code to production. Most wanted to approve irreversible actions themselves. Few wanted to approve each small step. Trust is not fixed. Practitioners extend or shrink what an agent is allowed to do based on the task, the risk of a mistake, and how well they understand what the agent is about to do. A practitioner who trusts an agent to search the web may still want to confirm before the agent sends an email. The same practitioner may tighten those limits after one bad experience, then loosen them again after the agent earns that latitude back. The design recommendations from this work are direct. Show the human what the agent is about to do before it does something hard to reverse. Let the human set limits by category, not by individual action. Make it easy to see what the agent has access to and to cut that access at any point. Current tools ask the human to decide upfront, then give too little visibility into what the agent does with that latitude.