diff --git a/AGENTS.md b/AGENTS.md
index 4d07571edc..89ee46a39b 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -37,7 +37,9 @@ judgment, not a fixed stop: merge when the user or the task wants the work lande
 the body, or a human comment asking to wait); ask first when any of those is missing, or when the
 change alters what agents may do unattended. Launch unattended local lanes with
 `--permission-mode auto`; a lane whose action the auto-mode classifier denies records the denial
-in its lane telemetry and moves on. CI lanes run `--permission-mode dontAsk` instead, under
+in its lane telemetry and moves on. CI lanes run with no prompt handler, so an unlisted tool is denied: intake triage passes
+`--permission-mode dontAsk`, and the review lanes run claude-code-action's tag mode, which passes
+`acceptEdits` with a fixed tool allowlist. All run under
 the hardening in [ADR 0049](docs/adr/0049-run-ci-lanes-on-github-hosted-runners-under-trigger-and-token-hardening.md),
 which also answers the untrusted-text risk below for them. A hook `ask` or `permissions.ask` rule can open a dialog no one
 answers, so lane sessions carry none. `--permission-prompts none` is documented for print mode and