Why it matters: Directly targets the real failure mode of 'agent asked to add X quietly also modified critical payment/auth logic' before it reaches a PR review.
How to apply: Add the pre-commit hook to repos where coding agents have write access; require agents to declare an edit scope up front and let the hook reject out-of-scope diffs automatically.