Development / YOLO: unrestricted edits and normal builds are legitimate, with shadow-policy evaluation if desired. Do not claim an unrestricted agent is contained.
Commissioning / engineer in control: short-lived target-scoped engineer sessions and direct engineer actions reduce repeated approvals. A signed-in engineer never automatically delegates credentials to autonomous agents.
Managed operation: protected actions require independently enforced, audience-bound, short-lived authority. A policy prompt or read-only WebMCP tool is not a resource guard. Human approval does not guarantee physical safety.