Permission level

How much the agent may do without asking: plan-only, per-tool allowlist, auto-accept, no prompts. It is a blast-radius control, not a verification control — raising it does not make the work more correct, only less interrupted. This is the setting people change most often and reason about least. Pair every step up with a gate that does not depend on the model's own account of itself.