Guardrails and permissions

Decide what agents may do without asking, and enforce it on the endpoint.

A standing permission is an agent that no longer asks: run any command, push to git, write anywhere. The sensor reads every grant, the console says which ones the workspace forbids, and the endpoint removes them and keeps them out.