Rules decide whether a tool call happens; the sandbox decides what it can touch once it does. Rule syntax and the wildcard placement that widens a rule further than intended, path anchoring, working directories, and where the OS boundary goes.

Six permission modes decide what runs without asking. The evaluation order they sit inside, what each one actually approves, how auto mode's classifier makes its call, and the paths no mode will ever wave through.