The way it worked originally was it would trigger a different system prompt, and then the permissions system would prompt you (even on YOLO mode) before running any non-readonly actions.

Cursor would also write a plan document, which was useful when working on larger tasks (due to context size). I still find that part useful today.