The same gate in the Agent SDK

The gate is one callback, but whether it runs is decided before it: the permission order checks rules, allow lists and modes first, and only an undecided call reaches canUseTool. Listing send_enquiries in allowedTools (so the model may use it) and marking it always_ask on the server config (so the host is asked every time anyway) is the combination that makes the gate unavoidable. The decision that matters most is the edit path: the callback returns updatedInput, so the solicitor's version of the list is what the tool receives, while the model only learns about the change from the tool's result. The SDK doesn't run on your subscription, so the model comes from .env: any model through your OpenRouter key, or a local Ollama model.