Blast-radius control

The agent can touch more than the user can see, so permission becomes a blank cheque.

Scope what the agent may read, write, and send. Render the scope as a map, not a paragraph of policy. Default to the smallest scope that completes the stated intent.