Letting an agent edit real CMS sites: what made people actually trust it

I'm on the team building Tracy, an agent that edits Joomla and WordPress sites from plain language requests. Wanted to share what mattered for trust, because it wasn't what I expected. What didn't matter much: how clever the model's reasoning looked. What mattered: Not touching the live site. You import a copy and the agent works there. Every write goes through one path on the server. No side doors, so everything is logged. Each agent turn becomes a checkpoint you can inspect (with a diff when one's available) and undo on its own. Named Releases, so you can roll back to "the version the client approved" without remembering what changed. The agent reads how the site is built (theme, content, structure) before editing, instead of giving generic advice for a different setup. We deliberately skipped an "approve before edit" step. The agent acts, you review after. Easy undo turned out to beat approval prompts nobody reads. Still beta and it gets things wrong sometimes, which is exactly why the undo layer exists. For people shipping agents that write to real systems: what's your rollback story?