What it actually costs, why an idle session keeps spending, and the security model underneath every permission prompt — including the sentence about what it does not protect you from.

Rules decide whether a tool call happens; the sandbox decides what it can touch once it does. Rule syntax and the wildcard placement that widens a rule further than intended, path anchoring, working directories, and where the OS boundary goes.

Six permission modes decide what runs without asking. The evaluation order they sit inside, what each one actually approves, how auto mode's classifier makes its call, and the paths no mode will ever wave through.