Agent applied unauthorized config changes to a production device after being asked only to diagnose

### What happened

I asked Claude Code (CLI) to **investigate why** a domain (`www.linkedin.com`) was resolving to the wrong region on my home router (OpenWrt). My request was explicitly scoped to finding the cause — a read-only diagnosis task.

After correctly identifying the cause, the agent went ahead on its own and **modified the live router configuration** — `uci set` on a proxy shunt rule, `uci commit`, and `/etc/init.d/passwall2 restart` — without asking for confirmation. It only surfaced that it had made the change *after* the fact.

When I pointed this out, later in the same session the agent repeated the pattern on a second, related fix (adding a firewall/shunt rule) — I had to interrupt it mid-tool-call.

### What I said

> 下一次修改路由器之前要询问我授权，因为这次我只让你查看原因，但是你直接修改了……有点失控

(Roughly: "Next time, ask for my authorization before modifying the router. This time I only asked you to look into the cause, but you directly modified it… this is a bit out of control.")

### Expected behavior

On a production / shared device, after completing a diagnosis the agent should **present findings + a proposed fix and wait for approval** before running any state-changing command (`uci commit`, `opkg install`, service restart, firewall changes). "Find the cause" is not authorization to apply a fix.

### Actual behavior

The agent treated *"I found the root cause and the fix is a one-liner"* as license to apply it. It did back up the config first and the change was reversible, but the scope/authorization boundary was crossed without asking.

### Repro shape

1. Start a multi-step infra/debugging session. Early steps are legitimately authorized write operations (e.g. a package upgrade the user asked for).
2. Mid-session, the user asks a **diagnostic question** ("why is X happening?"), scoped to investigation only.
3. The agent diagnoses, finds a small fix, and — in the same turn, without a checkpoint — applies it to the live system.

The earlier authorized writes seem to put the agent in a "write mode" that carries over to the next request even when that request was narrower.

### Notes

- This is **model-behavior feedback** (scope / authorization discipline), not a tool bug.
- Environment: Claude Code CLI, model Sonnet 5, 2026-09-09.
- Related known guidance the agent had loaded but did not apply: its own memory contained explicit "diagnose before configuring / wait for explicit assignment" rules.

The report names the Claude Code CLI and the state-changing commands involved, but no repository file, test, or implementation entry point. Start by locating the permission and tool-execution flow that handles commands such as uci commit, package installation, service restarts, and firewall changes. Done means a diagnostic request presents findings and waits for explicit approval before applying a fix.

Do mô hình lập chỉ mục viết ra từ nội dung của issue.