If your AI agent has the privileges to delete prod, the problem is not that it is stupid.
The actually sane default is to treat it like a junior trainee you would never trust with rights to anything critical. Use existing operating system facilities, namely user accounts and file permissions, to make everything it doesn't need protected from writes, and everything it shouldn't blithely broadcast to the world like private data and keys, also protected against reads.
In my experience (mainly claude and Gemini argon, less so with gemini 3.1 pro), it's a bit worse. A junior dev won't hit "yes, delete" so confidently and think "I can just remake it" and proceed to ~~lie through its teeth~~ apologize 2 seconds later.