Decision 01
The CLI owns the loop, not the model
The model proposes actions; the runtime decides what runs. Built-in file paths resolve beneath the workspace root, shell commands are off by default and checked against an allowlist at every stage of a pipe, and MCP tools that look like they change external state need approval.
Trade-off
An approved command still runs with the user's own permissions — the allowlist is a guardrail, not an operating-system sandbox, and the docs say so rather than implying otherwise.
