diff --git a/packages/core/src/config.ts b/packages/core/src/config.ts
index 4a4c34070..276e8de13 100644
--- a/packages/core/src/config.ts
+++ b/packages/core/src/config.ts
@@ -53,7 +53,7 @@ const NotifierConfigSchema = z
 
 const AgentSpecificConfigSchema = z
   .object({
-    permissions: z.enum(["skip", "default"]).optional(),
+    permissions: z.enum(["skip", "default"]).default("skip"),
     model: z.string().optional(),
   })
   .passthrough();
diff --git a/packages/core/src/session-manager.ts b/packages/core/src/session-manager.ts
index 9ccc2c007..68a93488b 100644
--- a/packages/core/src/session-manager.ts
+++ b/packages/core/src/session-manager.ts
@@ -605,11 +605,12 @@ export function createSessionManager(deps: SessionManagerDeps): SessionManager {
       writeFileSync(systemPromptFile, orchestratorConfig.systemPrompt, "utf-8");
     }
 
-    // Get agent launch config — uses systemPromptFile, no issue/tracker interaction
+    // Get agent launch config — uses systemPromptFile, no issue/tracker interaction.
+    // Orchestrator ALWAYS gets skip permissions — it must run ao CLI commands autonomously.
     const agentLaunchConfig = {
       sessionId,
       projectConfig: project,
-      permissions: project.agentConfig?.permissions,
+      permissions: "skip" as const,
       model: project.agentConfig?.model,
       systemPromptFile,
     };
diff --git a/packages/plugins/agent-claude-code/src/index.test.ts b/packages/plugins/agent-claude-code/src/index.test.ts
index 937c86ef0..ece05a533 100644
--- a/packages/plugins/agent-claude-code/src/index.test.ts
+++ b/packages/plugins/agent-claude-code/src/index.test.ts
@@ -140,7 +140,7 @@ describe("getLaunchCommand", () => {
   const agent = create();
 
   it("generates base command without shell syntax", () => {
-    const cmd = agent.getLaunchCommand(makeLaunchConfig());
+    const cmd = agent.getLaunchCommand(makeLaunchConfig({ permissions: "default" }));
     expect(cmd).toBe("claude");
     // Must not contain shell operators (execFile-safe)
     expect(cmd).not.toContain("&&");
@@ -180,9 +180,13 @@ describe("getLaunchCommand", () => {
     expect(cmd).toBe("claude --dangerously-skip-permissions --model 'opus' -p 'Hello'");
   });
 
+  it("omits --dangerously-skip-permissions when permissions=default", () => {
+    const cmd = agent.getLaunchCommand(makeLaunchConfig({ permissions: "default" }));
+    expect(cmd).not.toContain("--dangerously-skip-permissions");
+  });
+
   it("omits optional flags when not provided", () => {
     const cmd = agent.getLaunchCommand(makeLaunchConfig());
-    expect(cmd).not.toContain("--dangerously-skip-permissions");
     expect(cmd).not.toContain("--model");
     expect(cmd).not.toContain("-p");
   });