A script runs the Cursor CLI in non-interactive print mode against a real checkout, with no permission rules configured. What is the agent able to do to the files there?

The principle — Approval prompts belong to interactive sessions. Print mode has nobody to ask, and the CLI resolves that by granting access rather than withholding it.

Why the key is correct — Cursor has full write access in non-interactive mode. A script or CI job can therefore edit real files in a real checkout with no prompt in the way, the opposite of what most people expect.

Why the others are wrong — Read-only behaviour is the intuitive guess and the dangerous one, since print mode uses write and shell tools. Edits are not queued for review later, and they are not diverted into a temporary copy unless you ask for a worktree. What limits print mode is permission rules you configure.

Remember this — Interactive mode asks; print mode acts. Set permissions before pointing a script at a checkout.

Sources — Cursor's Using Agent in CLI documentation.