From read-only retrieval to on-chain writes, give each action appropriate authorization.
Start with least privilege
Define permissions by resource, action, expiry and budget. Starting with read-only tasks and expanding after validation keeps authorization understandable and reviewable.
Make human approval explicit
Actions such as asset transfers, contract deployment and permission changes need an explicit approver. Workflows should show the approval request, impact and stopping conditions in advance.
Preserve reviewable records
Record authorization sources, policy decisions, tool calls, times and results to reconstruct execution. Denied permissions and paused workflows should remain explicit states.
