Why Permissions Beat Prompts for Controlling Actions