Authorization pipeline before every tool call
Mode → Rules → Trust → Sandbox → Execute
tool call
packet travels left → right; deny stops; ask pauses
1
Mode
Plan · Normal · Always
→
deny
2
Permission rules
deny rm · allow pytest
→
3
Folder trust
trusted?
→
4
Sandbox
OS fence
→
5
Execute tool
run