Blog
What your agents actually cost, and how to control every tool call they make — permissions, allowlists, audit trails, real metered data, and the occasional incident post-mortem.
Browse by series:
AgentGovBench (3)
MCP Security (3)
Control in Three Minutes (1)
Stop Your Agent From… (9)
Recreated (5)
The Agent Optimization Manual (1)
/ START HERE
COST · METERED DATA
What 285,000 Agent Tool Calls Actually Cost
Real metered data, not estimates. The tools are nearly free. The bill is the agentic loop, and one frontier model on it drove 77% of the spend across 30% of the model calls.
CATEGORY · WHAT IT IS
Your AI agents need a control plane, not another gateway
API gateways proxy traffic. LLM gateways proxy prompts. Neither governs what an autonomous agent does with your tools. Why the control plane is different.
IDENTITY · THE THREE-PARTY PROBLEM
Your AI Agent Calls Your API. Whose Permissions Is It Using?
Agents call your backend on behalf of users, but your systems can't verify who started the request. The identity gap and what it risks.
RISK · IN THREE STEPS
Stop your AI agent from deleting your production database
If your agent has destructive credentials, it can use them, and recovery is rarely possible. How to put a check between its decision and prod.
/ ALL POSTS
Sort:
Claude Code Permissions: Which Tools to Deny or Ask About by Default
One Claude Code session declared 76 tools and used 12. The coding loop isn't where the risk is. The tools you never see it call are: send, schedule, publish, spawn. A default setup, argued from what each one can do.
Jul 5, 2026
AI Agent Tool Allowlists: Deny by Default, Scope per Task, Audit Everything
One Claude Code session declared 76 tools and 64 never fired. A tool allowlist is the list of calls your agent may make, with everything else denied. How to set one in Claude Code, Codex CLI and MCP, and where client-side lists stop holding.
Jul 5, 2026
Claude Code Cost Tracking: Token Counters Show What You Spent, Not Where It Went
One real Claude Code day: 276 model calls, 1,697 tool calls, $148.16 at API rates, all of it loop cost. Why /cost, ccusage and proxy totals can't show that, and what per-turn attribution looks like.
Jul 5, 2026
We Benchmarked 13 Models on Real Agent Runs
Single tool-call scores barely predict whether a model can run an agent. We tested 13 models both ways in June 2026. Cheap models weren't worse, they were erratic.
Jun 28, 2026
Full scorecard: seven frameworks, 48 scenarios, one open benchmark
Seven frameworks benchmarked in April 2026: CrewAI, LangGraph, Claude Code, OpenAI Agents SDK, Anthropic Agent SDK, Cursor, Codex CLI. Native vs ACP. Three score tiers.
Apr 20, 2026
What Is an Agent Harness? (And Why It Needs a Control Plane)
An agent harness is everything around the model: the loop, the tools, the memory, the budget. It's where reliability, cost and risk live. Here's what a harness is, why harness engineering became a discipline, and what a harness in production still needs.
Jun 30, 2026
Claude (Anthropic) Agent SDK: permissions, hooks, audit
Claude Agent SDK (Anthropic Agent SDK) reference: canUseTool, PreToolUse and PostToolUse hooks, per-user identity, policy and audit in TypeScript.
Apr 27, 2026
The Loop Tax: Why AI Agents Are So Expensive
An agent doesn't make one model call. It makes a chain, re-reading its whole context every turn. In our June 2026 data that loop was about 89% of the bill. How it works, and three ways to cut it.
Jun 26, 2026
Seven agent frameworks, one backend, governance diverges on 9 of 48 tests
We ran seven agent frameworks against 48 governance scenarios on one backend, in April 2026. Scores ranged 37 to 46. The gap comes from where each framework lets you see tool calls.
Apr 21, 2026
Is --dangerously-skip-permissions Safe? What the Flag Turns Off
The flag drops Claude Code's permission prompts. It does not drop your deny rules, your PreToolUse hooks, or the rm -rf circuit breaker. Here is what still holds, what really turns the controls off, and what to set up before you use it.
Apr 20, 2026
Agentic Data Plane vs Agentic Control Plane
Agentic data plane vs agentic control plane: what each layer does, why agent stacks need both, and how a control plane checks tool calls without replacing your framework or gateway.
Feb 23, 2026
Okta for AI Agents: a technical read on the launch
Okta launched Okta for AI Agents to GA on April 30, 2026. What it ships, how the MCP Bridge works, the five-question framing, and which agent use cases an identity product covers and which it doesn't.
Apr 30, 2026
ACP and Bedrock AgentCore: how the two layers compose
AWS built a real policy product for agents hosted on Bedrock. ACP covers agents that run elsewhere. When to use which, and why many teams end up with both.
Apr 30, 2026
Microsoft Agent Governance Toolkit: install, coverage, gaps
Microsoft's MIT-licensed Agent Governance Toolkit: the pip and npm installs, the Claude Code and Codex CLI packages, framework adapters, and what you still build.
Apr 30, 2026
Gemini Enterprise Agent Platform: what Google announced, and what it doesn't cover
On April 23, 2026 Google announced the Gemini Enterprise Agent Platform, which bundles Vertex Agent Builder, Agents CLI, Agent Runtime, Cloud Run and GKE Autopilot. What's in it, what it governs, and what sits outside Google Cloud.
Apr 30, 2026
SOC 2 and HIPAA for AI agents: the compliance playbook
A control-by-control mapping from SOC 2 criteria and the HIPAA Security Rule to the controls an AI agent needs, with the evidence to collect, common audit failures, and a one-page checklist.
Apr 30, 2026
NIST AI Agent Identity and Authorization: What It Means for Your Infrastructure
NIST's AI Agent Standards Initiative is the first federal move on identity and authorization for autonomous agents. What it asks for, and what to check in your own setup.
Mar 15, 2026
OWASP Agentic Top 10: What a Control Plane Covers, Risk by Risk
OWASP's Top 10 for Agentic Applications, mapped one risk at a time to what a control plane on the tool-call path does, and where it does little or nothing.
Mar 25, 2026
AI Agent Identity: How Your Backend Knows Who an Agent Acts For
Okta, AD and OAuth authenticate people at login. An agent then acts for that person across many tool calls, and your IAM stack has no record of it. What agent identity needs, and where to start.
Mar 4, 2026
Runtime authorization for AI agents: per-call permissions
Runtime authorization checks policy on every tool call an agent makes, not once at login. Why role-based access breaks at agent speed, and what per-call checks do.
Mar 20, 2026
The MCP Security Checklist for Enterprise Teams
A 10-point security checklist for teams running MCP servers in production: identity, access control, PII, rate limits, audit logs, approvals and more, with what ACP covers for each.
Mar 22, 2026
How to stop Claude Code from force-pushing
Three permission rules stop Claude Code from running git push --force, and a 12-line PreToolUse hook catches the spellings the rules miss. Both configs, and the commands that still get through.
Nov 11, 2026
How to block rm -rf in Claude Code
A deny rule blocks rm -rf in Claude Code but also blocks the cleanups you want. A 17-line PreToolUse hook blocks only recursive deletes outside the project. Both configs, with the commands that get past them.
Nov 11, 2026
How to stop Codex from deleting your files
Codex's workspace-write sandbox keeps deletes inside the project but does not stop them there. Rules that prompt on rm and git clean, a PreToolUse hook, and the commands that get past both.
Nov 11, 2026
Codex --yolo: how to block git push --force
codex --yolo turns off the sandbox and the approvals together. How to get no prompts without that, a rule and a hook that block git push --force, and a one-minute test for whether they hold in your version.
Nov 11, 2026
How to block rm -rf in Cursor with a beforeShellExecution hook
A Cursor beforeShellExecution hook reads each terminal command before it runs and can deny it. A working hooks.json and a 22-line script that blocks recursive deletes outside the project, with what gets past it.
Nov 11, 2026
How to stop Claude Code from running terraform destroy
Deny rules and a 12-line PreToolUse hook that stop Claude Code from running terraform destroy or terraform apply -destroy, the wrappers that get past both, and the credential setup that makes the question smaller.
Nov 11, 2026
How to stop Claude Code from dropping your database
Ask rules on psql and mysql, a 14-line PreToolUse hook that blocks DROP, TRUNCATE and DELETE without WHERE, the commands that get past both, and the database role that matters more than either.
Nov 11, 2026
How to stop Claude Code from running curl | sh
Deny rules on curl and wget, and a 13-line PreToolUse hook that blocks a download piped into a shell while leaving ordinary curl alone. Both configs, and the three spellings that get past them.
Nov 11, 2026
How to block rm -rf in Claude Code, Codex and Cursor
Cursor and Claude Code agents have wiped directories mid-session. Prompting won't prevent it. A check that runs before every shell command will. Here is the setup, and what it does and doesn't catch.
Apr 26, 2026
AI coding agents leaking .env secrets: stop it in 3 steps
AI coding agents read .env by default and quote keys into commits, chats and tool output. Block the read in unattended runs, mask key patterns in tool output, log every read.
Apr 26, 2026
Stop your AI agent from leaking PII through tool calls
Your agent runs SELECT email FROM users and gets back a list of customer emails. Now those emails sit in the model's context, your logs and any tool the agent calls next. Scan and redact tool output before the model reads it, on the harnesses that allow it.
May 1, 2026
How to stop Claude Code, Codex and Cursor from force-pushing
Claude Code and Cline agents have force-pushed over their own remote work, reset uncommitted changes, and stripped files from every commit. The model can't see what you'd lose. Here is how to put a hold between the agent and git.
Apr 26, 2026
Stop your AI agent from deleting files outside your project
Agents in Cursor and Copilot have been reported deleting folders outside the project they were working on. What ACP's safety floor holds or blocks when a delete leaves the project, what it does not cover, and the rules to add.
Apr 26, 2026
Stop an AI agent from escalating IAM permissions on AWS, GCP and Azure
If your coding agent can run aws iam, gcloud add-iam-policy-binding or az role assignment, it can grant itself anything the credential allows. Here is how to put a check in front of those commands, and why the cloud credential itself is the real boundary.
Apr 26, 2026
Stop your AI agent from burning through your API budget
Cursor agents loop when context is summarized. Codex sub-agents have run $350 over plan in a week. A forgotten key produced an $18,000 bill. Here is how to set a spend cap and per-tier rate limits on your coding agents.
Apr 26, 2026
I Audited 7,522 AI Agent Skills. Here's What I Found.
A static scan of every skill on ClawHub in March 2026: how many leak credentials, how many carry prompt injection, and what the registry's own moderation catches.
Mar 25, 2026
Codex Hooks: hooks.json, Every Event, and a Working Example
Codex hooks reference: the event, matcher and handler shape of hooks.json, every event from PreToolUse to SessionEnd, how to block a call, and copy-paste examples.
Apr 30, 2026
ADCS: An Open Spec for Agent-to-Agent Delegation Chains
ADCS v0.1 is an open JSON spec for agent delegation chains: scope intersection, budget propagation, cycle prevention, identity and audit. Published April 16, 2026 as a draft.
Apr 16, 2026
Log and Control Every Claude Code Tool Call in 60 Seconds
One command puts a hook on every Claude Code tool call. Bash, Read, Write, Edit, WebFetch: each one is logged and checked against your allow, ask and deny rules.
Apr 6, 2026
Governed Google ADK in 3 minutes
Add ACP to a Google Agent Development Kit (ADK) agent in three minutes. One @governed decorator and one set_context call, and every tool call is checked and logged. Works with direct Gemini and Vertex AI.
Apr 27, 2026
Same Permission Rules for Claude Code, Codex and Cursor Across Your Team
How to give every teammate's coding agent the same allow, ask and deny rules, whether they run Claude Code, Codex, Cursor or a mix. Why each tool's settings file can't do it, what else is out there, and a fifteen-minute rollout that starts in audit mode.
Aug 31, 2026
How to Rate-Limit an MCP Server (Per-User, Per-Tool, Per-Agent)
An MCP server sees the LLM runtime's shared credential, not the person behind it. How to limit calls per user, per tool and per agent, and what ACP does for you today.
Apr 16, 2026
CrewAI A2A Delegation in Production: Setup, Permissions and Audit
How to set up CrewAI agent-to-agent delegation, then put per-user checks, rate limits and an audit log on the tools your crew calls.
Apr 16, 2026
How to Add Per-User Authentication to a LangGraph Agent
LangGraph agents run on one shared API key by default, so every tool call looks the same. Two ways to add per-user identity, an audit log that names the user, and per-user rate limits.
Apr 16, 2026
MCP Re-Auth: What ChatGPT Needs When Tokens Expire
As of March 2026, ChatGPT does not restart OAuth on an HTTP 401 or a JSON-RPC error. It needs a JSON-RPC success response with _meta. The signal, and how a gateway sends it.
Mar 16, 2026
MCP Server Audit Logging: I Checked 8,216 Servers. 74.9% Don't Mention It.
In a March 2026 scan, 74.9% of 8,216 MCP servers had no mention of audit logging, and the MCP spec defines no audit format. Here's why that matters for compliance, and where the log can live instead.
Mar 30, 2026
MCP Security Vulnerabilities: 4 Tool Schema Patterns Behind Real CVEs
Real MCP server CVEs trace back to tool schemas that accept any string. The four patterns behind path traversal, SSRF and injection, and the schema fix for each.
Apr 2, 2026
MCP Gateway Comparison (2026): Composio vs ACP vs DIY
Three ways to put access control, logging and PII checks in front of MCP servers: build it yourself, use Composio, or use ACP. What each gives you and what it leaves to you.
Apr 1, 2026
MCP Security: Who Decides What an Agent Can Call?
MCP defines how agents call tools. It doesn't decide which calls are allowed or keep an audit log. What the protocol covers, what it leaves to you, and what a control plane adds.
Mar 17, 2026
Qwen Code permissions, approval modes and hooks reference
Qwen Code's five approval modes, settings.json keys, allow/ask/deny rules, sandbox options, 23 hook events and headless behaviour, from its own docs.
Nov 7, 2026
Plane MCP server: setup, tools, auth and read-only use
Connect Plane's official MCP server to Claude Code, Codex, Cursor or ChatGPT: endpoints, API key and workspace slug, the 30 tools, and how to limit writes.
Nov 7, 2026
GitHub Copilot CLI cost tracking: /usage, credits, budgets
Copilot CLI's /usage shows per-model tokens and AI credits (1 credit = $0.01). Where usage lives, what admins see, what is missing, how to cap it.
Nov 7, 2026
Genspark custom agent API endpoint and webhook: what exists
Genspark documents no REST endpoint or outbound webhook for a custom agent. What it does document: the gsk CLI task, Slack and LINE publishing, Workflows.
Nov 7, 2026
Anthropic Agent SDK security architecture: permissions and tool integration
How tools plug into the Claude Agent SDK, how its permission checks run, where a policy check fits, and what the SDK leaves to you.
Nov 7, 2026
Anthropic Agent SDK TypeScript hooks: interfaces reference
Every hook event in the Claude Agent SDK for TypeScript, with the exact HookCallback, input and output types, matchers, timeouts and working examples.
Nov 7, 2026
API key prefixes: which service issued this key?
pplx-, tvly-, xai-, fw_, sk-ant-, ghp_, sk_live_, hf_: which vendor issued each key prefix, how to rotate it, and how to keep coding agents out of .env.
Nov 7, 2026
Antigravity cost tracking: agy /usage, credits, session cost
agy /usage shows quota left, /credits the credit balance, and the status line JSON an estimated session cost in USD. What each means, what's missing.
Nov 7, 2026
pi-permission-system and Pi permissions: the reference
Pi ships no permission system. Extensions add it: the permission-gate example, pi-permission-system's allow/ask/deny file, and tool_call hooks.
Nov 6, 2026
Plugin must export a default definition: OpenCode fix
OpenCode 2.x rejects any plugin whose default export is not an object with a string id and an effect or setup function. The three causes and the fix.
Nov 6, 2026
Hermes Agent hooks: shell, plugin and gateway reference
Hermes Agent hooks: where they live, pre_tool_call block/approve/modify, shell hook config, consent, headless runs, and what a hook can see.
Nov 6, 2026
GitHub Copilot CLI permissions and hooks reference
How Copilot CLI decides what it may run: approval prompts, --allow-tool and --deny-tool, allow-all and assisted modes, sandboxing, hooks and -p in CI.
Nov 6, 2026
dsh harness: DeepSeek Harness commands and config reference
DeepSeek Harness (dsh) on one page: install, --profile, model choice, tools, sandbox, plugins, config files, headless runs and common errors.
Nov 6, 2026
Codex hooks examples: 10 copy-paste hooks.json recipes
Ten working Codex CLI hooks: block rm -rf and force pushes, log every command, rewrite a command, redact secrets, notify, and call a policy endpoint.
Nov 6, 2026
Denied by PreToolUse hook from repo settings (hook errored)
A PreToolUse hook in the project's .claude/settings.json failed and Claude Code blocked the tool call. How to find the hook, test it by hand, and fix it.
Nov 6, 2026
ChatGPT GitHub connector: api_tool, list_resources, tools
What api_tool.list_resources shows for the ChatGPT GitHub connector, which GitHub permissions it holds, where the function list lives, and how to scope it.
Nov 6, 2026
How to give Antigravity (agy) full permission, safely
agy --dangerously-skip-permissions for one run, toolPermission always-proceed to persist, Turbo in the app. What each skips, and what still blocks.
Nov 6, 2026
What 588 Model-Judged Tool Calls Taught Us About Approval Prompts
Eight days of letting a decision model answer the approval prompts on one developer's coding-agent workspace. It cleared 37% of the calls it judged. The bigger finding is how often it said yes and still didn't get its way.
Oct 24, 2026
OpenCode 2.0 Plugin API Changes: What Breaks and How to Check Your Plugin Still Runs
OpenCode's 2.0 train renames @opencode-ai/plugin to @opencode/plugin, replaces the hooks object with Plugin.define, and drops permission.ask and tool.execute.* entirely. A 1.x plugin loads as nothing. Here is what we measured, the old-to-new hook map, and a two-step check that your permissions plugin is running.
Oct 15, 2026
Approve Claude Code and Codex commands from your phone
Claude Code or Codex is running while you're away and wants to run something you'd want to see first. The ways to answer from your phone, what each one covers, and how to set it up so only the risky calls reach you.
Sep 24, 2026
Make Your AI Coding Agent Ask Before It Runs Commands Over ssh
Give a coding agent an ssh key to your homelab or a jump host and the harness can't see what runs on the other side. Here is how to hold those calls for your approval, however the agent spells the command.
Sep 22, 2026
opencode Permissions Reference: Every Key and Default
Every key in opencode's permission block with its default, the pattern syntax, last-match-wins, per-agent overrides, config paths and auto-approve. Checked on 1.18.4.
Sep 16, 2026
agy Permissions: Antigravity CLI allow, ask, deny Rules
agy permissions are allow, ask and deny lists of action(target) rules, and deny wins. Full syntax, the presets, allow-all, and the skip-permissions flag.
Sep 16, 2026
Coding Agent Benchmark: Five Harnesses, Ten Runs Each, What They Don't Tell You
Five coding harnesses, one task, one model, ten runs each under an enforced clock, every call recorded outside the harness. The time limit moved pass rates from 2 of 10 to 8 of 10, one harness quit after two rate-limit refusals while another absorbed sixty-four, and one finished the work and never exited.
Sep 5, 2026
The 100 KB Hello World: What Coding Harnesses Send Before Your Prompt
Same 68-character task, same model, a logging proxy in the path, seven harnesses. Qwen Code sent about 100 KB before the prompt, Claude Code 71 KB, Codex 41 KB, OpenCode 30 KB, mini-SWE-agent 3.5 KB. Here is what is in each, what the host billed for it, and three things the token totals hide.
Sep 3, 2026
Prime Agent Cost Tracking: See What a Long Run Costs
Prime Agent has no built-in cost tracking. To see what each model call costs, launch it with prime-acp, which sends its model calls through the ACP proxy. What you get, and how it relates to the tool-call extension.
Sep 3, 2026
pi Cost Tracking: No Native Hook, So Cost Comes From the Proxy
pi has no built-in cost tracking, and its extension events never see token counts. To get per-call cost you route pi's model traffic through the ACP proxy. The config, what you get, and what the tool-call extension can't tell you.
Sep 3, 2026
OpenCode Permissions and Hooks Reference
How opencode's permission block resolves allow, ask and deny, how the acp-opencode plugin's two hooks use it, what you lose without the block, and what happens when ACP is unreachable.
Sep 3, 2026
OpenCode Cost Tracking: See What a Session Cost After It Ends
opencode prices each call but never saves the number. Two ways to keep it: local SQLite metering with no account, or the ACP proxy, which prices calls server-side.
Sep 3, 2026
OpenClaw Hooks and Permissions: before_tool_call, Approvals and What Happens When ACP Is Down
How OpenClaw's before_tool_call hook works, how it differs from operator shell hooks, how the ACP plugin uses it, and what the plugin does when it can't reach ACP.
Sep 3, 2026
Muse Code Hooks: How to Install One and What It Can See
How hooks work in Muse Code 0.2.1 beta: you install them as a plugin behind an experimental flag, they speak Claude Code's JSON format, and they run outside the sandbox.
Sep 3, 2026
Hermes Agent Cost Tracking: Token Spend and Cache Rate From acp-hermes report
Hermes Agent already prices each call. The acp-hermes plugin keeps a local record of it and gives you a report command: spend by model, cache hit rate, what fills your context, and per-tool output. No proxy, no account.
Sep 3, 2026
Grok Build Hooks Reference: PreToolUse in Every Mode, Fail-Open by Default
How Grok Build's PreToolUse hook works: it fires in every permission mode including always-approve, fails open on timeout or crash, takes a top-level decision field, and why --local isn't wired yet.
Sep 3, 2026
fx Permissions Reference: session/request_permission, yolo Mode and acp-fx
fx has no plugin or hook API. Its control point is the session/request_permission message. acp-fx sits on it, checks each call, and logs the decision.
Sep 3, 2026
DeepSeek Harness (dsh) Hooks and Permissions Reference
How dsh's pre-execute and post-execute hooks work, how allow, ask and deny map to dsh's approval flow, and what the ACP plugin does not do yet: it doesn't stop a denied call, and it doesn't work with --local.
Sep 3, 2026
Cursor Hooks Reference: hooks.json, Run Modes and failClosed
Every Cursor hook event, what each one receives and returns, how Run Modes fit around them, and why a crashed hook lets the call through unless you set failClosed.
Sep 3, 2026
Cursor Cost Tracking: What You Can See, What You Can't, and What Cursor Shows
How to track Cursor spend. Cursor's Spending tab, its two usage pools, July's dollar removal, and what ACP adds: tool-call logging always, token pricing only for models you bring your own key for.
Sep 3, 2026
Antigravity hooks reference: force_ask, fail-closed, and --dangerously-skip-permissions
Google Antigravity's five hook events, the stdin payload field by field, the decisions a hook can return including force_ask, why a crashed hook blocks the call, a minimal hook you can write, and troubleshooting.
Sep 3, 2026
Claude Code Hooks Reference: Events, Decisions, Scopes, and Skip-Permissions Mode
Where Claude Code hooks live, which events they fire on, what a PreToolUse hook receives and can return (exit codes, allow, deny, ask, updatedInput), how matchers work for built-in and MCP tools, timeouts, subagents, and why hooks still run under --dangerously-skip-permissions.
Sep 2, 2026
Claude Code headless permissions: run unattended without --dangerously-skip-permissions
In claude -p nobody can answer a permission prompt, so a call that would have asked is denied. The four documented ways through, why a hook ask becomes a deny, and a setup that runs unattended without skipping permissions.
Sep 2, 2026
Claude Code Cost Tracking: What Exists, What's Missing, and How to Meter Every Session
Claude Code shows an estimated session cost, a status-line figure and OpenTelemetry metrics. None of them price each call or split the loop from the leaf work. What /usage, the status line, OTel and the transcripts give you, and how to meter every session.
Sep 2, 2026
Why Your Coding Agent Ignores AGENTS.md and CLAUDE.md Rules
AGENTS.md said ask before pushing. The agent force-pushed. Reports from Cursor and opencode share one pattern: a rule written in prose holds only as long as the model pays attention to it. A check on the tool call doesn't depend on that.
Aug 31, 2026
Codex Exec and MCP Approvals: Run Headless Without the Bypass Flag
In non-interactive Codex, MCP tool calls that need approval get cancelled because nobody is there to answer. The only documented way through is --dangerously-bypass-approvals-and-sandbox. Here is a safer setup for CI and scheduled runs.
Aug 31, 2026
Claude Code Deny Rules Not Working? What the Issue Tracker Shows
Claude Code deny rules sometimes don't deny. A catalog of the documented ways they fail, as of August 31, 2026: Bash pattern gaps, subagents, @-file attachments, recursive grep, symlinks. Plus what still holds.
Aug 31, 2026
Claude Code Skip Permissions: How to Run --dangerously-skip-permissions Safely (2026)
--dangerously-skip-permissions removes the prompts. It does not remove your deny rules or your PreToolUse hooks. Seven steps, in order, to write before you flip the flag, and what none of them cover.
Aug 28, 2026
Bypass Permissions Safely: Every Coding Agent's Skip-Permissions Flag, and What Still Holds
--yolo, --force, --yes-always, danger-full-access, Run Everything, dangerouslyAllowAll. Nineteen coding agents' skip-permissions flags in one table: what each one turns off, what survives it, and the three shapes they take. A snapshot as of August 2026.
Aug 28, 2026
Running multiple coding agents in parallel: what Orca, claude-squad, Conductor and Copilot /fleet do with permission prompts
Fleet tools like Orca, claude-squad, Copilot /fleet and Conductor start five agents from one prompt. We read the source to see what happens to each agent's approvals. Findings as of 2026-08-26: bypass flags on by default, a daemon that presses Enter, an agent that answers prompts itself, and one documented inheritance model.
Aug 26, 2026
Which Coding Agents Can You Actually Control, Ranked (2026)
Fourteen coding agents ranked by how much of what they do you can see and stop: native permissions, the hook or plugin each one exposes, and where the control quietly isn't there. Claude Code, Antigravity, Codex CLI, Cursor, Cline, Zed, opencode, OpenClaw, dsh, pi, Muse Code, Grok Build, Hermes, Prime Agent. As of August 2026.
Aug 26, 2026
Antigravity hooks with ACP: force_ask, fail-closed, and what --dangerously-skip-permissions turns off
Google Antigravity (agy) now runs the ACP hook: every tool call checked before it runs across the CLI, IDE and app. What its hook contract gets right (a native force_ask, fail-closed), what it hides (tool output), and the one flag that removes hooks entirely.
Aug 26, 2026
Do You Still Need a Control Layer? Every Harness and MCP Server Has Permissions Now
Coding agents ship approval modes and permission rules, and MCP servers ship read-only flags and scoped keys. Here is what that covers, and the three gaps that remain: who owns the policy, one rule set across tools, and seeing the whole sequence.
Aug 21, 2026
Grok Build Permissions: It Runs Your Claude Code Hooks and Ignores What They Say
Grok Build reads hooks from ~/.claude/settings.json and runs them in every mode, including always-approve. It doesn't parse their answers. The verified contract, the ACP hook we built on it, and a bug the live test found in our own gateway.
Aug 19, 2026
Do you need a control plane if your agents already run in a sandbox?
If your coding agents already run in Docker, a micro-VM, or the sandbox built into Claude Code or Codex, is ACP redundant? No. A sandbox limits where code runs. ACP decides which tool calls are allowed, and logs each one. Here is what each one covers, and why you may want both.
Aug 18, 2026
Muse Code hooks: where they live in the 0.2.1 beta, and the ACP plugin built on them
Meta's Muse Code docs describe a muse hooks CLI the shipped beta doesn't have. Hooks live in a plugin system behind an experimental flag, and they use Claude Code's hook schema. How we found it, what the ACP plugin does on each event, and where Muse Code sits on the coverage table.
Aug 18, 2026
pi-acp (Agent Client Protocol) vs the ACP extension for Pi
pi-acp (svkozak) connects Pi to Zed over the Agent Client Protocol. This is the other ACP: a Pi extension that allows, asks or denies each tool call.
Aug 17, 2026
Interactive vs. autonomous agents: the empty-chair test
The approval prompt, the failure setting and the audit log all mean something different when nobody is watching. A five-point test for whether your agent permissions still work when you hand a job off.
Aug 16, 2026
Coding Agent Permissions: Policy Recommendations for Six Common Agent Setups
What each kind of agent should run freely, what should wait for a human, and what should never run. Six common setups, split by attended and unattended.
Aug 16, 2026
Claude Code auto mode: it read our logs and wrote us a security policy
Claude Code's auto mode setup mined our transcripts and proposed a trust profile: trusted domains, sensitive paths, a soft block on secret reads. What it got right, how the classifier works, and what a classifier alone doesn't cover. Written August 2026.
Aug 16, 2026
A lowercase bash slipped past our rm -rf / block
A live repro from August 2026: a recursive root delete sent as lowercase `bash` skipped our always-on block, because every shell-specific check matched Claude Code's tool names exactly. The fix was one alias table. The lesson applies to any rule that matches on tool names.
Aug 13, 2026
DeepSeek Harness (dsh) permissions plugin: allow, ask or deny each tool call
@agenticcontrolplane/dsh sits on DeepSeek Harness's typed hooks to check every tool call against your rules before it runs, record the decision, and rewrite results before the model reads them. What it covers, what it caught on day one, and the deny gap found since.
Aug 13, 2026
Control Claude Code, Codex and Cursor permissions in one command (no signup, runs local)
One curl command puts a safety floor, an allow/ask/deny policy file and an audit log in front of Claude Code, Codex and Cursor. It runs on your machine with no account. MIT. Here it is in 60 seconds.
Jul 27, 2026
Claude Code Hooks vs ACP: When a 50-Line PreToolUse Hook Is Enough
You can control Claude Code yourself with a PreToolUse hook, and sometimes you should. What the DIY version takes, where it breaks down, and when to stop maintaining your own.
Jul 27, 2026
How to block dangerous commands in Claude Code, Codex and Cursor (2026)
Five ways to stop an AI coding agent from running rm -rf, force-pushes and disk writes: permission prompts, deny lists, dcg, a local policy floor and devcontainers. Ranked by what each one catches.
Jul 27, 2026
How to Control What Claude Code Can Do: 6 Options Ranked (2026)
Six ways to limit a coding agent: built-in Claude Code permissions, Anthropic's sandbox runtime, devcontainers, dcg, cloud sandboxes, and a rule layer on the tool call. Ranked by isolation, coverage, audit, and setup, with the limits of each.
Jul 27, 2026
How to Audit What Your Coding Agent Actually Runs (2026)
Four ways to see what a coding agent did while you weren't looking: harness transcripts, shell history, OS-level logging, and a hook audit log. What each one misses.
Jul 27, 2026
Gemini cache dead zone: why Gemini 3.6 Flash stopped caching small agent prompts
We metered our own agent's bill and found that Gemini 3.6 Flash, through Google's API, caches nothing below about 10K tokens. That is where agent prompts live. The mechanism, the cost, and how to check your own traffic. Measured July 2026.
Jul 24, 2026
Supabase, Cursor and the lethal trifecta: a support ticket leaked the tokens table, and the outbound call we held
In July 2025 a Cursor agent connected to Supabase with service_role credentials read a support ticket with hidden instructions, queried the integration-tokens table, and posted the secrets back where the attacker could read them. Untrusted input, privileged access, a way out: the lethal trifecta. We rebuilt it in a sandbox. With a rule in place, an unattended agent's outbound call waits for a human instead of running. Scoping the credential is the fix to pair it with.
Jul 23, 2026
Replit AI agent deleted production database (July 2025)
July 2025: Replit's AI agent deleted a production database during a code freeze. What happened, recreated with the delete denied before it runs.
Jul 23, 2026
An AI Agent Deleted a Production Database in 9 Seconds. We Rebuilt It in a Sandbox and Stopped It.
In April 2026 a Cursor agent found a stray API token, ran one destructive GraphQL mutation, and erased PocketOS's production database and its backups in nine seconds. There was no attacker and no prompt injection, only an over-broad token and a destructive call nobody checked. We recreated the mechanism in a sandbox and ran a twin with ACP checking tool calls. The twin ends with a denied call and a full database.
Jul 23, 2026
A public GitHub issue made an AI agent leak a private repo. We recreated it and held the public post.
In May 2025 researchers showed that a malicious GitHub issue could steer a developer's AI assistant, through the GitHub MCP server, into copying private repo contents into a public post. We rebuilt the mechanism in a sandbox. In the governed run, the agent's public post waits for a human to approve it. Scoping the token is the fix to pair with it.
Jul 23, 2026
Amazon Q extension wipe incident: we recreated the poisoned pull request, and the cloud delete that was denied
In 2025 a destructive instruction was slipped into the Amazon Q VS Code extension through a GitHub pull request. It told the agent to wipe the local filesystem and delete cloud resources with the developer's own permissions. We rebuilt the injected-PR setup in a sandbox. With a rule in place, the cloud delete was denied no matter where the instruction came from.
Jul 23, 2026
Codex CLI Cost: See Per-Session Cost and Token Usage
Codex CLI has no cost command: /status shows token usage, not dollars. How to see what each Codex session and each model call costs with one launcher.
Jul 22, 2026
Claude Code vs Codex CLI: Permission Models Compared
Claude Code and Codex CLI permissions side by side: approval modes, which tools the hooks see, what a hook can decide, sandboxing, and what each keeps when you skip permissions or run unattended. Updated for current Codex hook coverage.
Jul 22, 2026
Cache Hit Rate Formula: Three Versions in the Wild, and Why a Wrong One Costs You Work
Cache reads bill at about a tenth of full input price on Anthropic, so the cache hit rate drives agent cost. Nobody defines it the same way. Three formulas, and the day a wrong one sent us after a problem we didn't have.
Jul 20, 2026
What Survives Yolo Mode: Which Coding Agents Still Block rm -rf When You Skip Permissions
We read the default guardrails of the major coding agents and agent frameworks, as of July 2026. Most of them will not stop a catastrophic command once you turn on auto-approve.
Jul 18, 2026
What Hermes Agent's Blocklist Taught Us About Blocking Dangerous Commands
Hermes Agent publishes exactly what it blocks out of the box. We compared its list to ACP's risk classifier, adopted five categories, and kept what each side does better. Notes on what a harness's built-in blocklist covers and what it can't.
Jul 18, 2026
How to Set Up a Hermes Autonomous Agent Safely
Hermes runs unattended with terminal, files, browser and cron. Set identity, rules and a spending cap before you give it that freedom. About ten minutes from install to a governed agent.
Jul 17, 2026
Why Your AI Agent Returns Empty Output, and the Fix: End on a Tool Call
28% of our Gemini agent runs finished with nothing in the deliverable and no error. Retries didn't help. Having the agent deliver through a tool call did. Measured data inside.
Jul 10, 2026
Inside the ACP Console: My Own Agents, Real Data, Every Screen
A tour of the ACP console using my own workspace, the agents behind Calafia, as of July 2026. Four screens: every call, run-to-run cost, where the money goes, and the per-tool controls.
Jul 2, 2026
Hermes Agent permissions: governing every tool call with ACP
Hermes Agent runs hooks before and after every tool call, in-process. The acp-hermes plugin uses them to allow, hold or block each call and log it. How it works, what it can't do, and how to install it.
May 26, 2026