Single control plane
Every write goes through the same funnel.
Kill switch, mode, approval, limits, credential and idempotency — in one funnel.
Automation without governance becomes risk: a stray rule changes real budget with no one watching.
Nine gates before any write.
Nothing ships without a human decision.
Auditable trail, per-action idempotency.
Every write goes through the same funnel.
Provider writes off by default.
Human queue with full context.
First real write: PAUSE only, reversible.
PROVIDER_WRITES_ENABLED=false. No real mutation happens in shadow mode.
Start in shadow mode: everything is simulated, nothing is published. You promote real execution when you decide.