Permission

Dangerous actions need a harness decision point before the shell runs.

Not every tool should run automatically. Insert a permission layer between the model's request and execution.

Classify tools by risk; ask the human only when the action is destructive or irreversible.