Plan mode does have different permission controls though? Its difficult for me to parse the docs on this but it does seem to imply more than just a prompt although less than a full sandbox. https://code.claude.com/docs/en/permission-modes#analyze-bef...

The way it worked originally was it would trigger a different system prompt, and then the permissions system would prompt you (even on YOLO mode) before running any non-readonly actions.

Cursor would also write a plan document, which was useful when working on larger tasks (due to context size). I still find that part useful today.