Permission scopes for agents should be boring and narrow. I start with read only on one repo path and open write only after the plan passes review. Wide access is how quiet mistakes get loud.