What Workflow Agents Can Do Without Asking, and Preparing an Allowlist

Your team is about to let Claude Code run a large dynamic workflow overnight (an unattended session, nobody watching) that migrates configuration files across a 150-file monorepo. Someone on the team says: "We're in Manual permission mode, so every edit will still prompt for approval — we're safe to just let it run."

1. Explain concretely why this claim is wrong, tying your answer to exactly what governs a workflow agent's tool calls versus what governs the session's own permission mode.
2. List the categories of action that will still stop the run to ask for approval, even though file edits won't. What does this imply about what "unattended" actually means for a workflow run, as opposed to a genuinely walk-away-safe automation?
3. Design a concrete allowlist-preparation checklist you'd run through before starting this overnight run, given what you now know about how workflow-agent permissions actually work.