That's why they have an "auto" mode that you should be using over the "bypass permissions". no matter how many guardrails you put on it. AI is not deterministic, so sometimes it likes to do whatever it wants.