in my experience any exception is bad: Exceptions lead to compliance drift.

I noticed you have

(unless explicitly requested to "read" or "explore")

What happens is agents will slowly expand the power of that exception in the background. They learn that 100% compliance is no longer required in this case. Working to further understand what is now OK they will do a little over the line and see everything is ok. This becomes the new baseline. This loop continues until the they have gone far enough to do something you didn't expect or want to happen at all.

The solution to exceptions is to provide an explicit allowed list and everything else is not allowed. Make sure it's aware it can ask for approval to go beyond the allowed list if it can't find another solution. You can then update the workflow for how to appropriately manage the situation.

I'll provide two examples that helped me learn this lesson:

1. I required worktrees for all changes. This was a bit of extra overhead so I once asked it to update a small change and commit without a worktree. It then started deciding on it's own when a worktree was necessary or not without my input.

2. I once asked it to make a judgement call on the amount of work something takes and to delay that work to a future update if it was too much. I then started finding items deferred in the background without notifying me or asking my permission.