You can't really 'figure out' the rule that imposes restrictions on a client side interface of your models. As long as cli exists, third party software will always be able to interact with it, whether Anthropic likes it or not.

This is why it's so inconsistent and confusing. They simply can't come up with a rule that only affects OpenClaw/pi/etc and not 'allowed' automations. You either permit automation, or you don't. Right now, they want to have it both ways.