[API] Decide: should read-only execute_command types auto-execute under the default per_step approval mode?

[ToddHebebrand]

Description

Product/policy decision extracted from #3088. PR #3105 tiers read-only execute_command commandTypes (list_processes, file_list, event_logs_list) down to Tier 2 — but under the default session approval mode (per_step), Tier-2 calls still take a lightweight inline confirmation; only auto_approve and plan modes truly auto-execute. So per-step users still get one (lighter) prompt per read-only call, and the original approval-fatigue scenario (25 prompts in 35 minutes) is reduced but not eliminated for them.

Deciding to skip Tier-2 prompts in per_step would change semantics for every Tier-2 tool (e.g. file_operations list actions), not just these — hence a deliberate decision rather than a rider on #3105.

Options

• Keep as merged (per-step always confirms; users who want silence switch modes).
• Auto-execute Tier ≤ 2 in per_step (bigger blast radius, revisit audit expectations).
• Per-commandType session grants ("don't ask again for list_processes this session") — middle ground.

Reported By

Review round on PR #3105 (issue #3088), finding 2.

[ToddHebebrand]

Decision: auto-execute an explicit read-only allowlist under per_step — not Tier ≤ 2 wholesale.

Tier 2 is "low-risk mutations + audit", so the tier-wide option would have removed confirmation from ~60 mutating actions (policy activate/deactivate, bulk patch approve, backup profile delete, collect_evidence, revoke_elevation, …) and made per_step behaviorally identical to auto_approve. The middle-ground per-commandType session grants were also rejected: a second gating mechanism alongside approval modes for the same outcome the allowlist delivers in ~15 lines.

Implemented in #3156:

• TIER2_READONLY_ACTIONS (execute_command list types, file_operations list, manage_services list) and TIER2_READONLY_TOOLS (the nine single-purpose get/list/search catalog/contract/invoice/quote tools) auto-execute under every approval mode, keeping the Tier-2 audit-ledger row (deliberately not a Tier-1 demotion).
• Paused sessions and active plan execution keep their existing semantics (pause still prompts for everything Tier 2+; plan-matched reads go through plan bookkeeping).
• Rider: the ai.tool.* audit event no longer hard-codes approved: true for tier ≥ 2 — it now records whether the call was explicitly decided, plus the concrete approvalMethod.