Security posture No autonomous privileged actions without policy. Credentials for actuators stay server-side.