Coding agents when you do not write code

You have a task a script would fix. Twelve CSV exports from three systems that you merge by hand every Monday. A folder of invoice scans named IMG_4471 through IMG_4802. A price list your supplier sends in one format and your shop wants in another. You have never written a line of code, the quote you got to have it built was more than the annoyance is worth, and so the Monday morning ritual continues.

Coding agents change that arithmetic, and they have quietly stopped being terminal-only tools for engineers. Claude Code reads your codebase, edits files, and runs commands, and it is available in your terminal, IDE, desktop app, and browser [1]. Codex, OpenAI’s agent, can read files, make edits, and run commands in the workspace [5], and runs on the web, in the CLI, in the IDE extension, and on iOS [6]. Both come bundled with subscriptions you may already hold: Claude Code is included on the Pro plan at $20 a month [4], and Codex appears on ChatGPT plans starting at Free [6]. So the skill that matters is no longer programming. It is knowing which jobs are safe to hand over, which settings stop the agent before it does damage, and where the line sits beyond which you hire a person. If you already ship software for a living, this guide is not for you; go to the vendor docs, which are better than any summary of them.

You no longer need a terminal to start

The old blocker was the command line. That has gone. Claude Code runs on several surfaces, and each one connects to the same underlying engine, so the CLAUDE.md files, settings and MCP servers you set up in one work across all of them [1]. The desktop app runs Claude Code outside your IDE or terminal, lets you review diffs visually, and includes Claude Code, so you do not need to install the CLI separately; a paid subscription is required [1]. The web version at claude.ai/code runs in your browser with no local setup [1].

The free tier is where the two products differ. Anthropic’s pricing page lists Claude Code as included on Pro, Max, Team and Enterprise, and not included on Free [4]. Pro is $20 if billed monthly, or $17 a month with the annual discount, billed $200 up front [4]. Codex draws the line lower down: its pricing page shows a Free plan at $0 for exploring Codex on quick coding tasks, a Go plan at $8, and Plus at $20 [6]. If you want to see whether any of this suits you before paying, that difference is the whole answer to where to start.

Pick one and stay with it for a month. Both will do the small jobs described below. Switching between them early costs you the accumulated setup and teaches you nothing about either.

The safe jobs are the ones you can check by eye

The sweet spot is small, self-contained, and verifiable. Merge twelve exports into one clean sheet. Rename a folder of scans by the date inside each file. Convert a price list between two formats. Pull the four numbers you retype every Monday into one summary. Anthropic’s own framing is that Claude Code handles the tedious tasks that eat up your day [1], and for a non-developer the tedious tasks are usually file shuffling rather than software.

The property these jobs share is not that they are easy. It is that you can look at the result and know whether it worked. You have twelve input files and you know roughly how many rows should come out. You can open three renamed invoices and check the dates. That check is the whole safety system, because you cannot read the code. Testing beats inspection when inspection is not available to you.

This rules out a specific and tempting category: jobs where the output looks plausible whatever the answer. A script that reconciles two ledgers and reports a difference of some precise-looking amount gives you a number you have no independent way to confirm. A script that categorises 800 transactions produces 800 answers you will not check. Those are not small jobs with a tidy output. They are jobs where a silent error survives for months, and they belong in the next category, not this one.

Permission modes are the real safety feature

The single most useful thing to learn is not a prompt. It is which mode the agent is running in, because that determines what it can do without asking you.

In Manual mode, Claude Code starts with read-only permissions, and when it needs to edit files, run tests, or execute commands, it asks you first, and you choose whether to approve the action once or allow it from then on [2]. Plan mode goes further in the useful direction: Claude reads files, runs shell commands to explore, and writes a plan, but does not edit your source, and edits stay blocked until you approve the plan [3]. Starting in plan mode is the closest thing to a free look at what is about to happen, in language you can read.

Auto mode is what you get without changing anything. On Pro, Max and Team plans, the built-in starting permission mode is auto mode [3], where a separate classifier model reviews actions instead of you and blocks the ones it judges unsafe [2]. That is convenient and it is not the same as your judgement. Switch permission modes with Shift+Tab in the CLI, the mode indicator in VS Code, or the mode selector in Desktop [3], and move to Manual or Plan while you are learning what the agent does with your files.

Codex works on the same principle with different names. In its Auto preset, which needs no flags, Codex can read files, make edits, and run commands in the workspace, and requires approval to edit outside the workspace or to access network [5]. By default the agent runs with network access turned off [5]. On launch it detects whether the folder is version-controlled and recommends Auto for folders that are, and read-only for folders that are not [5], which means a plain folder of CSV exports gets offered the cautious setting by default. There is also a dangerous full access setting, reached with --dangerously-bypass-approvals-and-sandbox or its alias --yolo, which the documentation describes as no sandbox, no approvals, and not recommended [5]. Do not use it.

The equivalent in Claude Code is bypassPermissions, and Anthropic’s guidance on it is unambiguous: use it only in isolated environments like containers, VMs, or dev containers without internet access, where Claude Code cannot damage your host system [3]. If you are following this guide, that condition does not describe your laptop.

Give it a copy, in a folder of its own

The rule that has always mattered is to work on copies rather than originals, and the modern version of it is stronger, because the tool will enforce a boundary for you. In Manual mode, Claude Code can only write to the folder where it was started and its subfolders, and cannot modify files in parent directories without explicit permission; in Manual mode it also asks before reading paths outside that boundary with the Read, Grep and Glob tools [2]. For Codex, the default workspace-write sandbox limits what it can touch, typically to the current workspace, and anything outside it needs approval [5].

That turns the safety question into a question about one decision you make before you start: which folder did I open this in. Make a new folder. Copy the twelve CSV exports into it. Start the agent there. If the run goes badly, the blast radius is a folder of copies. If you start the agent in your home directory or in the folder holding the only copy of your accounts, the boundary is drawn around everything you own.

Two smaller habits go with this. Anonymise sample data before it goes into the chat, because a real customer list pasted in as “example input” is a real customer list. And be careful with anything the agent fetches from the web: commands that fetch content from the web such as curl and wget are not auto-approved by default, and in Manual mode they prompt like any other non-read-only Bash command [2], which is a hint about why. Anthropic’s own best-practice list for untrusted content says to review suggested commands before approval, avoid piping untrusted content directly to Claude, and verify proposed changes to critical files [2].

Make it review its own work, then check anyway

You cannot read the code, so the obvious move is to ask the agent to check it. This works better than it sounds, and it is now a shipped feature rather than a prompting trick. Anthropic’s security guidance plugin makes Claude review its own code changes for common vulnerabilities while it works and fix what it finds in the same session, catching issues such as injection, unsafe deserialization, and unsafe DOM APIs [7]. It reviews at three points, each at a different depth: a fast pattern match for risky calls on each file edit with no model call, a background model review at the end of each turn of everything that turn changed, and a deeper agentic review on each commit or push Claude makes [7]. Install it in a terminal session with /plugin install security-guidance@claude-plugins-official, and it is available on all plans [7].

Notably, it does not ask the same Claude instance that wrote the code to grade itself. The end-of-turn and commit reviews run as a separate Claude call with a fresh context and a security-focused prompt, and both model-backed reviews use Claude Opus 4.7 by default [7]. That independence is the part that makes self-review worth anything.

Then read the limits, because Anthropic publishes them plainly. None of the layers block writes or commits, the review model can miss issues, and the documentation says to treat the plugin as one layer of defense in depth, not a complete security solution [7]. The security documentation is blunter still: Claude Code only has the permissions you grant it, and you are responsible for reviewing proposed code and commands for safety before approval [2]. Elsewhere it warns that while these protections significantly reduce risk, no system is completely immune to all attacks [2].

So the sequence is: plan mode, read the plan, run it on a sample where you already know the answer, then ask what could break and what to check afterwards. The last question costs one message and returns a checklist written by the thing that just wrote the code. It is a second pair of eyes, not a guarantee.

The line where you hire a person

Some software belongs to professionals, and the reason is not that the agent cannot produce it. The reason is that you cannot evaluate it. The line is accountability for invisible failure.

Anything that takes payments. Anything customers log into. Anything storing personal data beyond your own. Anything that must keep running when nobody is watching it. In those areas, code that passes your eye test and works in the demo can be wrong in ways only an expert would notice, and the bill arrives months later.

There is also a policy line, and it is written down. Anthropic’s Usage Policy, effective 15 September 2025, sets additional safety measures for what it calls High-Risk Use Cases, a list that covers legal, healthcare, insurance, finance, employment and housing, academic testing and admissions, and media or professional journalistic content [8]. Where you use the products to provide advice, recommendations, or subjective decision-making directly affecting individuals or consumers, a qualified professional in that field must review the content or decision prior to dissemination or finalization [8]. And if model outputs are presented directly to those people, you must disclose that you are using AI to help produce your advice, decisions, or recommendations, at a minimum at the beginning of each session [8]. If the small tool you are about to build makes or shapes a decision in one of those areas, the professional review is not optional politeness. It is a term of use.

The self-check that settles most cases: if this failed silently for three weeks, what would have happened. Wrongly renamed invoices is an afternoon of annoyance. Wrongly reconciled accounts, or a form on your website that leaks the messages people send you, is a different category with a different price. Build the first. Buy the second.

Keep the description, not just the script

When an agent builds something useful, save three things together: the script, the plain-English description that produced it, and one sample input with its correct output. Put them in the same folder. Name the folder after the job, not after the tool.

The description is the asset. Scripts rot when the systems around them change, and the file format your supplier uses will change. A clear description regenerates a working script in minutes with whichever agent you are paying for that year. This is also the cheapest insurance against being locked to one vendor: the thing you own is the specification, not the output.

Claude Code has a formal version of this. CLAUDE.md is a markdown file you add to your project root that Claude Code reads at the start of every session, used to set standards and review checklists [1]. For a non-developer that file is the right home for “these CSVs always have a header row” and “never write to the originals folder”. It is a note to your future self that the agent happens to read.

What still goes wrong

The main hazard is confident, silent wrongness. An agent will produce a script that runs cleanly, prints no errors, and quietly drops the rows where a field was empty. Nothing in the permission system catches that, because dropping rows is not a dangerous action, it is a wrong one. The only defence is the sample where you know the answer, and the only way that defence fails is when you skip it because the first three runs looked fine.

Reviews are partial. The security plugin’s own documentation says none of the layers block writes or commits and the review model can miss issues [7], and that a review reads the source code in your checkout, not a running site or deployed service [7]. So a review can tell you the code has no obvious injection flaw and still tell you nothing about whether the thing you deployed is exposed.

And the convenient defaults drift towards autonomy. Auto mode is the built-in starting permission mode on Pro, Max and Team plans [3], the classifier is a model rather than you [2], and every prompt you approve from then on [2] widens what runs unwatched next time. That is a reasonable trade for an engineer with a version-controlled repository and a way to undo. It is a worse trade for someone whose undo button is a folder they hopefully copied. Check which mode you are in before a run that touches anything you would miss.

Prompts from this guide

brief-a-coding-agent

I am not a programmer. Build me a small script that does one job.

The job: {plain_english_task}

Input: {describe_input_files} — I have put copies in this folder.
Output: {describe_desired_output}

Here is one real example.
Input looks like:
{example_input}
Correct output for that input:
{example_output}

Rules:
1. Work only on files in this folder. Never write to anything outside it.
2. Never overwrite an input file. Write results to a new file.
3. If a row or file does not match the expected shape, skip it and list it
   at the end rather than guessing.
4. Print a one-line summary at the end: how many items were read, how many
   were written, how many were skipped.
5. Tell me in plain English how to run it.

Before you write anything, show me the plan and wait for me to approve it.
After it works, tell me what this script could break and what I should
check afterwards.