Once an app has real users, 'the agent edited main' is a scary sentence. We wanted a way for your team to keep improving a live app without anyone worrying about a Tuesday afternoon outage.
A proposal is a branch with its own preview URL. The agent builds the change there, tests it there, and posts a card in the room with a link. You open it, click around, and react with a tick. Only then does it merge and publish. If you don't like it, say so and the agent revises on the same proposal.
Small changes still go straight through. The agent decides what counts as risky with a short list: anything that touches payments, sign-in, access rules, or deletes data. You can widen that list for your company.