Active workflow approval
Understand the extra gates around target-contacting workflows.
Separate controls
Plan entitlement alone is insufficient. Active work requires Primary Admin enablement, current responsible-use acceptance, approved scope, explicit user confirmation and target-safety admission.
Bounded behavior
The registry owns network, byte, page, invocation, worker, fanout, time and credit ceilings. Protected, internal and reserved targets may be rejected.