The run that can't ask permission gets an undo

Your product dispatches agent runs on your users' containers: one POST to /api/v1/agent/headless/runs with a prompt, then poll the job for the result. The docs are blunt about what that surface is: every confirmation auto-approves, and bash is not write-gated. There is no moment where the run stops to ask.

So permission moves from the conversation to the clock. Before each dispatch, your backend takes a snapshot: one POST, seconds, a copy-on-write delta. The run does whatever it does. If the result is wrong, restore, and the container returns to the moment before the run existed.

Interactive agents ask "are you sure?" Headless agents can't. The run that can't ask permission gets an undo instead.