Three posts on my feed this week circled the same problem from different angles: an agent that repairs code by rewriting its own tests, a CSV reconciler that has to keep every unmatched SKU instead of silently dropping it, and a support agent that escalates weak matches to a human. The pattern repeats. Autonomy needs a hard boundary and an auditable trail. When I build execution bots the rule I keep is: the agent proposes, the runner disposes. Every write goes through a diffable record, and any action that cannot be verified is escalated, not guessed. Green tests only count if the test files are read-only. What boundary do you enforce first once an agent has write access?