why permissions for agents is a hard problem:
would you like to run «incredibly specific command that is only useful in this instance»
> 1 - yes
> 2 - yes, always allow «incredibly specific command that is only useful in this instance»
