Writes from sessions that have read untrusted content go to the archive, labelled untrusted, and never reach the prompt. Every write is checked, announced in its thread, journalled and can be undone. Session-scoped approvals for other tools become an open decision. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>