diff --git a/CHANGELOG.md b/CHANGELOG.md
index ef9dbca..124cf3b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -8,6 +8,10 @@ Please choose versions by [Semantic Versioning](http://semver.org/).
 * MINOR version when you add functionality in a backwards-compatible manner, and
 * PATCH version when you make backwards-compatible bug fixes.
 
+## Unreleased
+
+- feat: `work-on-task-assistant` Phase 5 now prompts the `accept edits` permission-mode switch when the extracted workflow assigns cluster/deploy mutations to the operator. Stating the operator/agent split was not enough on its own — observed 2026-08-16, the block correctly said "the **operator** runs the cluster mutations" and the session still spent ~40 minutes handing back command blocks until the owner interrupted. The split says who may run the command; the new line makes the switch that lets the agent run it in-session.
+
 ## v0.109.3
 
 - fix: make `session-close` Phase 2 idempotent. It mandated invoking `/vault-cli:sync-progress` with no guard for having already run in the same conversation — but the command's own Integration section lists `sync-progress` as the mid-session checkpoint, so running it and then closing is the expected path, and the second invocation appends duplicate "What happened today" entries. Phase 2 now documents the skip and requires stating it in the Phase 9 output, so Phase 7's representation check still has something to verify against.
diff --git a/agents/work-on-task-assistant.md b/agents/work-on-task-assistant.md
index b6f901a..71180e7 100644
--- a/agents/work-on-task-assistant.md
+++ b/agents/work-on-task-assistant.md
@@ -158,6 +158,21 @@ If code task:
 - Search vault for `*Development Guide.md` and read if found
 - Extract: branch strategy, test command, PR process, deploy steps
 - Present as "⚠️ **Development Workflow**" section in the report
+- **Permission-mode precheck.** If the extracted workflow assigns cluster or deploy
+  mutations to the operator rather than the agent (`make apply`, `make buca`,
+  `kubectl` writes, `helm install/upgrade`, ssh deploys, prod runbook steps), append
+  this line verbatim to that section:
+
+  > 🔐 **Permission mode:** this task's ops commands need `accept edits` — switch
+  > with Shift+Tab now, so they run in-session instead of being handed back as
+  > command blocks to paste.
+
+  Stating the operator/agent split alone is not enough. Observed 2026-08-16: the
+  workflow block correctly said "the **operator** runs the cluster mutations", and
+  the session still spent ~40 minutes handing back command blocks until the owner
+  interrupted with "as always, I don't want to run any commands — you should
+  suggest switching to the edit mode". The split describes who *may* run the
+  command; this line makes the switch that lets the agent actually do it.
 
 If not a code task: skip.