I use Coder with one workspace per project. A workspace is an isolated VM and I let the agents loose there. They can do anything they want in the workspaces but once the code is pushed, it's reviewed by an external agent before being merged. It's not an elaborate setup. It started very straightforward and the basic setup still works for me, but I have been adding some features here and there over time.