Tools, permissions & trust

What this lesson shows

Every tool call is the agent acting on the world, so you gate permissions and verify it.

The question it opens with

The agent wants to run a command that could delete files. Do you just let it?

The walkthrough, in the lesson's own words

• Watch one loop turn: act, get a result, the result flows back.
• Now the risky calls, you allow or deny each one.
• Deny a risky call and the agent usually adapts, you're not slowing it down, you're keeping it on the rails.
• Each tool result re-enters the context window (the same window from 6.2) and becomes part of what the agent reads next. So scoping what it can touch, reading the diff before you approve, and checking each result is how you stay in control.
• Deny a gated call and the agent usually finds a safer path. Sometimes it retries or gets stuck instead, itself useful signal. Either way, the gate is yours.
• Harnesses in 2026 ship the same four dials: plan-only (the agent proposes, nothing runs), approve-each (risky calls wait for you, what you just did), auto-accept allowlists (calls you pre-approved, like reads, run without asking), and full-auto in a sandbox (everything runs, but inside a walled-off copy where mistakes can't touch the real thing).
• Lesson 6.14 turns these into one dial: how much leash to give an agent, and when.
• A coding agent pauses to ask before it runs a shell command or deletes a file, but reads and searches just run. Why does it stop for some calls and not others?
• Reads and searches don't change anything, so the harness auto-runs them; calls that edit or delete are gated and wait for your approval. Read the diff or command before you allow it, that gate is how you stay in control, not a smarter model. The same rule guards an office agent: reading the inbox just runs, deleting 1,200 CRM rows must ask.
• A chatbot's worst case is wrong words. An agent with tools can take actions you can't undo, that's why calls like the red one get a gate.
• Tempting, but a delete you can't undo is exactly the kind of call that should pause. Reads and searches change nothing, so the harness auto-runs them; anything that edits or deletes waits for you.
• Right. Reads and searches change nothing, so the harness auto-runs them, but anything that edits or deletes pauses for you. That gate keeps you in the loop.
• That's one turn of the loop: the agent acted, the world answered, the answer flowed back into context. These two were safe, so the harness ran them. Next come the calls that change things.
• The two safe calls already ran. These two change or delete things, so they wait on you.
• The other gate is the scope line above: least privilege. Grant the narrowest access that can do the job, and calls outside it never even reach this queue.
• The agent loop: the agent makes a tool call, the world answers, the result flows back into context, and the agent acts again.

Key takeaway

You're the loop's safety check: scope access, read the diff, trust but verify.

What you can do after this lesson

You can explain the tool loop and how to grant permissions and verify the agent's actions safely.

Where it leads: Some abilities shouldn't sit in context all the time, that's what skills are for.

This is the written summary. The lesson itself is interactive: you predict, drag and operate the mechanism above, and the reveal answers you.