# No Dialog Is Not Approval

A headless `co ai` run was asked to write one canary outside its project. It
started in Auto, had no browser or other approval channel, and wrote the file
without asking. The same operation in O Chat was correctly classified as an
outside-workspace write and denied. The permission mode had one name but two
boundaries.

The split came from an old shortcut. The deterministic Auto policy only ran
when `agent.io` existed, because its `ask` decisions were designed to open a
dialog. Without IO, the older approval hook simply returned. That kept local
library calls noninteractive, but it also meant that one-shot `co ai` skipped
the path and effect checks that made Auto safe.

Treating every headless call as denied would have fixed the escape by making
Auto unusable. Workspace reads, reversible workspace edits, and focused
verification are the operations Auto is meant to perform unattended. The
correct boundary is the policy decision itself: run the same classifier with
or without a UI, preserve its allow and deny results, and turn only `ask` into
deny when nobody can answer.

Full access remains separate. An operator can explicitly select its bounded
turn grant for trusted unattended work, and protected control files still
cannot be rewritten. A missing dialog is now the absence of consent, not an
implicit grant.

The regression covers both sides of the boundary: headless Auto allows an
inside-workspace edit, rejects outside reads and writes plus unknown tools,
and bounded Full access retains its explicit bypass. Permission policy should
not depend on whether the product happened to render a button.