Approval gates for agent writes

Where should permission live when an agent can write?