Ownership zones explained
In short
Every part of your codebase carries one of three markers — //!AUTO (the agent owns it), //!SAFE (the agent proposes, you approve), //!DEV (humans only) — written in the source itself, so AI permissions are code you can read and change.
Ownership zones are how Sapilon answers “what is the AI allowed to touch?” with something you can read in the file instead of trusting to a system prompt.
The three zones
| Marker | Who owns it | What happens on a change |
|---|---|---|
//!AUTO | The agent | It changes the code directly. Logged, diffed, reversible. |
//!SAFE | Shared | The agent proposes a diff; a human approves before it lands. |
//!DEV | Humans only | The agent does not modify it. |
Where zones come from
New projects arrive already zoned: generated scaffolding, wiring, and boilerplate land in
//!AUTO, while decision-carrying code — pricing, permissions, state machines, anything with
money or safety in it — tends to start as //!SAFE. Nothing is //!DEV unless you say so.
Changing a zone
Zones are ordinary source annotations: edit the marker and commit. Promoting a file to
//!DEV is how you take something off the table permanently; relaxing one to //!AUTO is how
you speed up an area you no longer want to review by hand.
Do it deliberately. A codebase that is entirely //!AUTO gives up the review surface that
made the AI safe to run; a codebase that is entirely //!DEV is one you are writing yourself.
Why this instead of an approval setting
A global “ask me first” toggle is either off (and useless) or on (and exhausting), because it cannot tell a CSS tweak from a change to how refunds are calculated. Zones put the distinction where the distinction lives — in the code — so the boring 90% moves at machine speed and the 10% that matters stops for a human.
Next: Editing generated code · When the agent stops · Glossary: ownership zones