Claude Code doesn't trust Claude with permissions

How Claude Code enforces permissions with deterministic code, not model inference. The one LLM-based path is internal-only, fail-closed, and stripped from the public package.