A coding agent asks for permission to modify packages/web/generated/client.ts . The path looks harmless, the proposed diff sounds reasonable, and the user clicks Approve. That approval means very little if the system has not resolved where the write will land. A symlink or another layer of indirection can make the effective destination different from the path in the dialog. The human reviewed one operation while the machine executed another. A confirm button becomes a security boundary on...