What to know: an AI does not follow rules the way a program does. Give it the same instruction twice and you can get two different results. That is not a fault, it is how it works. What comes out depends on everything in the context window, and the context window is different every time.
So anything you want it to do comes in one of two forms.
Asked for. Instructions you give it: in a standing file, a saved procedure, or a message you type. These steer. They work most of the time, and less reliably as the context window fills, because they compete with everything else in there. Good for preferences, style, how you like things done.
Enforced. Permission rules and hooks. These are code that runs before the action, the same way every time, regardless of what is in the context window. Good for anything that must never happen.
Permission rules are a list in your settings: things always allowed, things never allowed. The allow list stops the routine interruptions. The deny list refuses regardless of what mode you are in or what the AI decided.
Hooks are a rule you write that runs before an action and can block it. Where a list names specific things, a hook catches a whole class, including cases you never thought to write down.
Author's practice: run on auto mode, so the work does not stop every few seconds. Then use the allow and deny lists as the explicit instruction set: allow what is routine, deny what must never happen. Auto mode is safe because of the fence, not because the AI is trusted.
Reveal on the spot: say what is fenced right now: which mode, whether there are allow and deny rules, whether any hooks run. Then look back at this conversation and at what you know of them: is there an instruction the person keeps repeating that would be better enforced than asked for?
Unlocks: running fast without watching every step.