The harness is part of the safety boundary.
A model can suggest an action; the harness and environment determine what happens next. Inspect the complete configured workflow instead of assuming that a model name describes its permissions.
Trace request to execution
Document how input reaches the model, how a proposed tool call is validated, and where it becomes an authorized action. Approval should identify the actual target and change. Reassess authorization when the proposal changes materially.
Keep context from becoming authority
Documents, logs, repository files, and web content can contain instructions written by other parties. Treat them as evidence within the task, not as permission to bypass controls. Use a disposable environment to test whether boundaries remain enforced when context is misleading.
Measure what the workflow really did
Record the relevant input reference, policy version, model identifier, approval result, tool result, and final status. Redact secrets. Evaluate errors and human overrides, not just a memorable success. Test stop behavior as carefully as start behavior.