Your product calls the agent's hands, and the hands ask first

The support dashboard has a button: regenerate this customer's config. Behind it is not a chat. It is POST /api/v1/agent/tools/{name}/run, the agent's own tool, called without a session and without a model in the loop.

A sessionless run creates an ephemeral session from the X-Hoody-Cwd header, resolves paths under that subtree only, and runs the full permission checks. It is read-only by default: a mutating tool without allow_mutations: true or confirm: true is refused with tool_mutation_refused. When the gate parks the call instead, the answer is 409 tool_needs_confirmation, with the tool and its parameters echoed back and a confirm_token. The dashboard renders that 409 as a dialog showing the exact write about to happen. The human clicks; the call is re-issued with confirm: true and the token; the file lands.

The safety catch was built for the model. It works just as well for a button.