Alright, I've been spelunking through the Agent SDK docs and the inheritance model for tool permissions feels like a hand-wave. They talk about defaults, overrides, and scopes, but the precedence is a black box.

Example: I define a strict default policy in the agent's config. Then I attach a more permissive grant to a specific tool via a route. Which wins? The SDK's examples show both patterns but never a conflict. If the route-level grant overrides the agent-level policy, that's a massive footgun. Where's the actual decision tree documented? Show me the code path, not the marketing copy.

What are we actually trusting here? Is the final permission set evaluated on the client side before the call goes to Anthropic, or is it evaluated on their end? That changes the entire threat model.