TOPIC
#security
A collection of 3 technical articles about #security.
Ask before writing, and refuse when nobody answers
Permission is not a true/false flag. It is a seam with a contract, three sandbox modes that speak only about files, and a safe default: no answer means no.
Permission sits on the path, not in the tool
A tool call passes seven stages before it reaches the tool body. Policy, hooks and sandboxing live there — and the tool itself need not know about them.
The model proposes, your code executes
The model sees only a tool declaration, never its execution. A tool call is a structured request your code validates, authorises, and then decides to run.