The layer that turns an instruction into a guarantee. Where each event fires in a turn, which ones can block, the exit-code contract, and the asymmetry that lets a hook tighten your permissions but never loosen them.

Rules decide whether a tool call happens; the sandbox decides what it can touch once it does. Rule syntax and the wildcard placement that widens a rule further than intended, path anchoring, working directories, and where the OS boundary goes.

Six permission modes decide what runs without asking. The evaluation order they sit inside, what each one actually approves, how auto mode's classifier makes its call, and the paths no mode will ever wave through.