Two layers, different authority
An instruction written into a rules file is followed when the model understands it and remembers it. A long session, a misread, or a confidently wrong turn can wear that down. A permission set in the tool's own configuration is different: it is checked by the harness before the command runs, not by the model, so no amount of reasoning gets around it. The written rules carry intent everywhere. The gate holds the line on the few actions where a single slip is expensive.
Reads that are refused, not prompted
Some files are denied outright rather than prompted for: .env files, private keys in .pem, .pfx, and .p12, SSH private keys, .git-credentials, and .netrc. The agent cannot open them at all. A secret it never reads is one it cannot paste into a commit, print to a log, or hand to a network call, no matter what a fetched web page tells it to do.
Actions that stop for a yes
A second set is not blocked but paused. Every git or GitHub change that alters a repository (commit, merge, push, tag, reset), every command that reaches another machine (ssh, scp, sftp, rsync), and every destructive local one (rm, dd, mkfs) waits for an explicit yes. These are the moves that are hard to undo, and pausing turns each into a decision instead of a side effect. A yes to one is not a yes to the next; each stop is its own.
The gap in the gate, and the hook that narrows it
The built-in matcher checks the start of a command, so a chained call slips through. cd project; git push does not begin with git push, so a name-based gate would wave it along. A small script runs before every shell command, reads the whole line rather than its first word, and asks the moment a gated command appears anywhere in the chain. It fails loud: if it cannot read or parse the command, it asks rather than assume the call is safe.
What it still cannot see is a command that is not on its list. A network call folded into a one-line python -c never names curl or git, so nothing catches it here. That is the boundary where the written rules take over, the Trifecta Rule in particular, because they cover the cases no gate can name.
A ceiling on delegation
A helper model can be given a task, but it is capped so it cannot spawn helpers of its own. One layer of delegation is a tool. Unbounded nesting is a way to lose track of what is running, on which branch, against whose approval, so the depth is fixed at one on purpose.