Prompt instructions are never sufficient for this. The tool call itself needs to be gated. With Claude Code, tools like Bash(“git *”) always ask for permission unless you’ve allowed it. Figure out the Cursor equivalent of that.
Any command needs to be allowed the first time in the ui for that run or for all (add to allowlist)