Yet one of the reasons harnesses abstract tool calls is to control what agents can do instead of just yoloing commands and inline python scripts. It's such a central feature, and agents are so hard to control, that harnesses like claude code and codex use an AI classifier to additionally auto-approve tool calls.