Why agent RBAC is broken in most CLI frameworks (and how to fix it)

Last Tuesday, a “helpful” coding agent in a staging environment did exactly what it was told: clean...