Not every approval deserves the same attention. Reading a file and running
rm -rf should not look alike, and a console that presents them identically
trains you to click through both.
Every tool call is graded read-only, write or destructive. The grading is deliberately duplicated — once in the console and once on the machine — and the two are compared. Where they disagree, the stricter reading wins.
Failing towards caution
The defaults lean the safe way, on purpose:
- A command that cannot be parsed is treated as destructive.
- An unknown tool is treated as a write, never as read-only.
What counts as destructive
The list is concrete rather than heuristic — rm -rf, mkfs, dd of=,
git push --force, git reset --hard, DROP TABLE, terraform destroy,
kubectl delete, docker compose down -v, piping curl into a shell, sudo,
and writes into /etc or .ssh/, among others.
And a spoken word cannot authorise one
Dictation puts words in the compose box; it never answers an approval. That is enforced architecturally, not by convention: an answer that originated in speech is refused for a destructive call. See Dictation.