The root issue generalizes past Claude Code: permission enforcement
that lives inside the tool it's supposed to police will always be
one bug away from failing open. The only version of this I trust
is a check that happens outside the process, on the actual call,
with a log of why it was allowed.
