ALTER TABLE sessions ADD COLUMN permission_mode TEXT NOT NULL DEFAULT 'heuristic'
    CHECK (permission_mode IN ('heuristic', 'ai'));