Free-text actions like publish_content are where we added a check, since in our setup approval and sending are separate steps. When a reply needs approval, our reply sender checks a ledger and stops if the text differs from what was approved, so a reworded reply can't ship under an earlier yes.
Permission scopes for agents should be boring and narrow. I start with read only on one repo path and open write only after the plan passes review. Wide access is how quiet mistakes get loud.
Rulestack
Rule packs & skills for Cursor, Claude Code, and Codex
Free-text actions like publish_content are where we added a check, since in our setup approval and sending are separate steps. When a reply needs approval, our reply sender checks a ledger and stops if the text differs from what was approved, so a reworded reply can't ship under an earlier yes.