Core principle

Request → Intent → Plan → Policy → Approval → Controlled connector → Result
                         Every transition → Audit

No orchestrator executes an external action directly. Unknown and destructive actions are denied by default; low-risk automation remains constrained to explicitly permitted operations.

The separation between planning and execution keeps provider credentials and external authority outside the reasoning layer. Approval does not broaden a connector's configured permissions; it authorizes only the bounded action presented for review.