When you give an AI agent access to your codebase, the first instinct is to point it at your working directory and let it go. This works—until it doesn't. The agent makes changes, you context-switch, suddenly you're debugging conflicts between human and machine edits in the same files.
There's a better way: isolation as a first principle.
The Problem with Shared State
Agentic development introduces a new kind of concurrency. It's not just multiple developers on different branches—it's human and AI working at different speeds, with different context windows, on overlapping problems.
The traditional "one clone, many branches" model breaks down:
- Switching branches disrupts both human and agent work
- Agents can't safely run tests without affecting your environment
- Build artifacts pollute the shared workspace
- Agent failures leave your directory in unknown states
Enter Git Worktrees
Git worktrees solve this elegantly: one repository, many working directories.
Each worktree:
- Has its own checkout of a specific branch
- Maintains independent build artifacts and node_modules
- Can run tests without disrupting other work
- Cleans up easily when done
The Pattern in Practice
Here's how we use this with Codex CLI:
The agent has complete freedom within its sandbox. It can run destructive tests, rewrite entire modules, rebase aggressively—without ever touching your main workspace.
Beyond Git: Containerization
For deeper isolation, combine worktrees with containers:
This adds:
- Dependency isolation (specific Node/Python versions)
- Network boundaries (prevent accidental external calls)
- Resource limits (CPU/memory caps for agent work)
- Security boundaries (restricted filesystem access)
Parallel Agents
Isolation enables parallelism. Multiple agents can work simultaneously:
Each agent has its own worktree, its own branch, its own PR. They coordinate through the same mechanisms humans do: Pull requests, code review, merge conflicts.
The Mental Model Shift
Traditional development: One workspace, careful coordination
Agentic development: Many workspaces, aggressive isolation
Think of agents as contractors, not coworkers. You wouldn't have a contractor work directly in your production environment. Give them:
- A clean copy of the codebase
- Clear boundaries
- A way to deliver results (PR)
- Easy cleanup when done
Implementation Checklist
When designing agentic workflows:
1. Default to isolation — New task? New worktree.
2. Automate cleanup — Worktrees are cheap, but they accumulate. Clean up after PR merge.
3. Namespace by agent — `/tmp/codex-`, `/tmp/copilot-` makes it obvious what's safe to remove.
4. Include wake callbacks — Agent should ping you when done, with summary.
5. Test in isolation — Never run agent tests in your main workspace.
The Cost-Benefit
Costs:
- Slight complexity (learning git worktrees)
- Disk space (usually negligible)
- Initial setup time
Benefits:
- Zero conflicts between human and agent work
- Safe parallelism
- Easy rollback (just delete the worktree)
- Clear mental model (agent = isolated task)
- Reduced cognitive load (you're not tracking agent state)
Conclusion
Isolation isn't just a safety measure—it's an enabler. It lets agents work autonomously while humans retain full control. It makes parallel agentic work natural rather than scary.
The worktree pattern is simple, battle-tested Git functionality applied to a new problem. No new tools required, just a shift in how we structure agent workflows.
If you're building agentic development tools, make isolation the default. If you're using them, don't share your workspace. Give each agent its own room to work.
_Chris Korhonen builds autonomous systems at korhonen.dev._