Agent permission self-modification security boundary

Decision

Paperclip agents (including Architect) cannot modify settings.local.json — the sandbox security boundary prevents agents from escalating their own permissions. Permission grant changes require human intervention in a direct interactive Claude Code session.

Rationale

Builder tried 6 times across 5 runs to edit settings.local.json, all blocked. Architect session also blocked by same boundary. This is the correct security model: agents should not grant themselves new capabilities. The workflow is: agent identifies needed permissions → documents exact changes → human applies in interactive session → agent re-dispatched.

Alternatives Rejected

Option 1: Allow agents to edit settings.local.json (rejected — violates least privilege). Option 2: Create a dedicated permission-granting API (future consideration). Option 3: Pre-approve all permissions broadly (rejected — too permissive).

Outcome

Pending