No open-ended access, even from bash

No tool tCode has, including bash, hands the model open-ended, standing access beyond what the current step actually needs. Each call is a single, self-contained action rather than the start of an interactive session.

bash specifically runs exactly one command and returns its output; it does not open a live shell the model can keep typing into indefinitely across multiple exchanges. This keeps every individual action reviewable on its own, one command shown, one command approved, rather than as part of an open-ended session you would have to watch continuously.

This constraint is part of why the permission model described in Permissions and safety stays meaningful call after call: each approval covers exactly the one action shown, nothing more, nothing standing.

This is a structural property of how every tool call is made, not a policy that could be relaxed by a setting; there is no configuration, including full auto-approve on every tool, that turns a tool call into an open-ended session rather than a single bounded action.

The practical upshot is that reviewing a transcript after the fact gives a complete, accurate picture of everything that happened, since nothing occurred outside of the individually visible, individually approved actions recorded in it.